Spring Boot Reference Guide

Authors

Copies of this document may be made for your own use and for distribution to
others, provided that you do not charge any fee for such copies and further
provided that each copy contains this Copyright Notice, whether distributed in
print or electronically.

Part I. Spring Boot Documentation

This section provides a brief overview of Spring Boot reference documentation. Think of
it as map for the rest of the document. You can read this reference guide in a linear
fashion, or you can skip sections if something doesn’t interest you.

1. About the documentation

Copies of this document may be made for your own use and for
distribution to others, provided that you do not charge any fee for such copies and
further provided that each copy contains this Copyright Notice, whether distributed in
print or electronically.

2. Getting help

Having trouble with Spring Boot, We’d like to help!

Try the How-to’s — they provide solutions to the most common
questions.

Learn the Spring basics — Spring Boot builds on many other Spring projects, check
the spring.io web-site for a wealth of reference documentation. If
you are just starting out with Spring, try one of the guides.

Part II. Getting started

If you’re just getting started with Spring Boot, or 'Spring' in general, this is the section
for you! Here we answer the basic “what?”, “how?” and “why?” questions. You’ll
find a gentle introduction to Spring Boot along with installation instructions.
We’ll then build our first Spring Boot application, discussing some core principles as
we go.

8. Introducing Spring Boot

Spring Boot makes it easy to create stand-alone, production-grade Spring based
Applications that you can “just run”. We take an opinionated view of the Spring
platform and third-party libraries so you can get started with minimum fuss. Most Spring
Boot applications need very little Spring configuration.

You can use Spring Boot to create Java applications that can be started using java -jar
or more traditional war deployments. We also provide a command line tool that runs
“spring scripts”.

Our primary goals are:

Provide a radically faster and widely accessible getting started experience for all
Spring development.

Be opinionated out of the box, but get out of the way quickly as requirements start to
diverge from the defaults.

Provide a range of non-functional features that are common to large classes of projects
(e.g. embedded servers, security, metrics, health checks, externalized configuration).

Absolutely no code generation and no requirement for XML configuration.

9. System Requirements

9.1 Servlet containers

The following embedded servlet containers are supported out of the box:

Name

Servlet Version

Tomcat 8.5

3.1

Jetty 9.4

3.1

Undertow 1.3

3.1

You can also deploy Spring Boot applications to any Servlet 3.0+ compatible container.

10. Installing Spring Boot

Spring Boot can be used with “classic” Java development tools or installed as a command
line tool. Regardless, you will need Java SDK v1.8 or higher. You
should check your current Java installation before you begin:

$ java -version

If you are new to Java development, or if you just want to experiment with Spring Boot
you might want to try the Spring Boot CLI first,
otherwise, read on for “classic” installation instructions.

10.1 Installation instructions for the Java developer

You can use Spring Boot in the same way as any standard Java library. Simply include the
appropriate spring-boot-*.jar files on your classpath. Spring Boot does not require
any special tools integration, so you can use any IDE or text editor; and there is
nothing special about a Spring Boot application, so you can run and debug as you would
any other Java program.

Although you could just copy Spring Boot jars, we generally recommend that you use a
build tool that supports dependency management (such as Maven or Gradle).

10.1.1 Maven installation

Spring Boot is compatible with Apache Maven 3.2 or above. If you don’t already have Maven
installed you can follow the instructions at maven.apache.org.

Tip

On many operating systems Maven can be installed via a package manager. If you’re an
OSX Homebrew user try brew install maven. Ubuntu users can run
sudo apt-get install maven. Windows users with Chocolatey can run choco install maven
from an elevated prompt.

Spring Boot dependencies use the org.springframework.bootgroupId. Typically your
Maven POM file will inherit from the spring-boot-starter-parent project and declare
dependencies to one or more “Starters”. Spring Boot also provides an optional
Maven plugin to create
executable jars.

The spring-boot-starter-parent is a great way to use Spring Boot, but it might
not be suitable all of the time. Sometimes you may need to inherit from a different
parent POM, or you might just not like our default settings. See
Section 13.2.2, “Using Spring Boot without the parent POM” for an alternative solution that uses an import
scope.

10.1.2 Gradle installation

Spring Boot is compatible with Gradle 3 (3.4 or later). If you don’t already have Gradle
installed you can follow the instructions at www.gradle.org/.

Spring Boot dependencies can be declared using the org.springframework.bootgroup.
Typically your project will declare dependencies to one or more
“Starters”. Spring Boot
provides a useful Gradle plugin
that can be used to simplify dependency declarations and to create executable jars.

Gradle Wrapper

The Gradle Wrapper provides a nice way of “obtaining” Gradle when you need to build a
project. It’s a small script and library that you commit alongside your code to bootstrap
the build process. See docs.gradle.org/3.4.1/userguide/gradle_wrapper.html for details.

10.2 Installing the Spring Boot CLI

The Spring Boot CLI is a command line tool that can be used if you want to quickly
prototype with Spring. It allows you to run Groovy scripts,
which means that you have a familiar Java-like syntax, without so much boilerplate code.

You don’t need to use the CLI to work with Spring Boot but it’s definitely the quickest
way to get a Spring application off the ground.

10.2.1 Manual installation

You can download the Spring CLI distribution from the Spring software repository:

Once downloaded, follow the INSTALL.txt
instructions from the unpacked archive. In summary: there is a spring script
(spring.bat for Windows) in a bin/ directory in the .zip file, or alternatively you
can use java -jar with the .jar file (the script helps you to be sure that the
classpath is set correctly).

10.2.2 Installation with SDKMAN!

SDKMAN! (The Software Development Kit Manager) can be used for managing multiple versions of
various binary SDKs, including Groovy and the Spring Boot CLI.
Get SDKMAN! from sdkman.io and install Spring Boot with

$ sdk install springboot
$ spring --version
Spring Boot v2.0.0.M2

If you are developing features for the CLI and want easy access to the version you just
built, follow these extra instructions.

10.2.3 OSX Homebrew installation

If you are on a Mac and using Homebrew, all you need to do to install
the Spring Boot CLI is:

$ brew tap pivotal/tap
$ brew install springboot

Homebrew will install spring to /usr/local/bin.

Note

If you don’t see the formula, your installation of brew might be out-of-date.
Just execute brew update and try again.

10.2.4 MacPorts installation

If you are on a Mac and using MacPorts, all you need to do to
install the Spring Boot CLI is:

$ sudo port install spring-boot-cli

10.2.5 Command-line completion

Spring Boot CLI ships with scripts that provide command completion for
BASH and
zsh shells. You can source the script (also named
spring) in any shell, or put it in your personal or system-wide bash completion
initialization. On a Debian system the system-wide scripts are in /shell-completion/bash
and all scripts in that directory are executed when a new shell starts. To run the script
manually, e.g. if you have installed using SDKMAN!

It will take some time when you first run the application as dependencies are
downloaded. Subsequent runs will be much quicker.

Open localhost:8080 in your favorite web browser and you should see the following
output:

Hello World!

10.3 Upgrading from an earlier version of Spring Boot

If you are upgrading from an earlier release of Spring Boot check the “release notes”
hosted on the project wiki. You’ll find upgrade instructions along with
a list of “new and noteworthy” features for each release.

This sample needs to be created in its own folder. Subsequent instructions assume
that you have created a suitable folder and that it is your “current directory”.

11.1 Creating the POM

We need to start by creating a Maven pom.xml file. The pom.xml is the recipe that
will be used to build your project. Open your favorite text editor and add the following:

<?xml version="1.0" encoding="UTF-8"?><projectxmlns="http://maven.apache.org/POM/4.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"><modelVersion>4.0.0</modelVersion><groupId>com.example</groupId><artifactId>myproject</artifactId><version>0.0.1-SNAPSHOT</version><parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>2.0.0.M2</version></parent><!-- Additional lines to be added here... --><!-- (you don't need this if you are using a .RELEASE version) --><repositories><repository><id>spring-snapshots</id><url>http://repo.spring.io/snapshot</url><snapshots><enabled>true</enabled></snapshots></repository><repository><id>spring-milestones</id><url>http://repo.spring.io/milestone</url></repository></repositories><pluginRepositories><pluginRepository><id>spring-snapshots</id><url>http://repo.spring.io/snapshot</url></pluginRepository><pluginRepository><id>spring-milestones</id><url>http://repo.spring.io/milestone</url></pluginRepository></pluginRepositories></project>

This should give you a working build, you can test it out by running mvn package (you
can ignore the “jar will be empty - no content was marked for inclusion!” warning for
now).

Note

At this point you could import the project into an IDE (most modern Java IDE’s
include built-in support for Maven). For simplicity, we will continue to use a plain
text editor for this example.

11.2 Adding classpath dependencies

Spring Boot provides a number of “Starters” that make easy to add jars to your
classpath. Our sample application has already used spring-boot-starter-parent in the
parent section of the POM. The spring-boot-starter-parent is a special starter
that provides useful Maven defaults. It also provides a
dependency-management
section so that you can omit version tags for “blessed” dependencies.

Other “Starters” simply provide dependencies that you are likely to need when
developing a specific type of application. Since we are developing a web application, we
will add a spring-boot-starter-web dependency — but before that, let’s look at what we
currently have.

$ mvn dependency:tree
[INFO] com.example:myproject:jar:0.0.1-SNAPSHOT

The mvn dependency:tree command prints a tree representation of your project dependencies.
You can see that spring-boot-starter-parent provides no
dependencies by itself. Let’s edit our pom.xml and add the spring-boot-starter-web dependency
just below the parent section:

If you run mvn dependency:tree again, you will see that there are now a number of
additional dependencies, including the Tomcat web server and Spring Boot itself.

11.3 Writing the code

To finish our application we need to create a single Java file. Maven will compile sources
from src/main/java by default so you need to create that folder structure, then add a
file named src/main/java/Example.java:

Although there isn’t much code here, quite a lot is going on. Let’s step through the
important parts.

11.3.1 The @RestController and @RequestMapping annotations

The first annotation on our Example class is @RestController. This is known as a
stereotype annotation. It provides hints for people reading the code, and for Spring,
that the class plays a specific role. In this case, our class is a web @Controller so
Spring will consider it when handling incoming web requests.

The @RequestMapping annotation provides “routing” information. It is telling Spring
that any HTTP request with the path “/” should be mapped to the home method. The
@RestController annotation tells Spring to render the resulting string directly
back to the caller.

Tip

The @RestController and @RequestMapping annotations are Spring MVC annotations
(they are not specific to Spring Boot). See the MVC section in
the Spring Reference Documentation for more details.

11.3.2 The @EnableAutoConfiguration annotation

The second class-level annotation is @EnableAutoConfiguration. This annotation tells
Spring Boot to “guess” how you will want to configure Spring, based on the jar
dependencies that you have added. Since spring-boot-starter-web added Tomcat and
Spring MVC, the auto-configuration will assume that you are developing a web application
and setup Spring accordingly.

Starters and Auto-Configuration

Auto-configuration is designed to work well with “Starters”, but the two concepts
are not directly tied. You are free to pick-and-choose jar dependencies outside of the
starters and Spring Boot will still do its best to auto-configure your application.

11.3.3 The “main” method

The final part of our application is the main method. This is just a standard method
that follows the Java convention for an application entry point. Our main method delegates
to Spring Boot’s SpringApplication class by calling run. SpringApplication will
bootstrap our application, starting Spring which will in turn start the auto-configured
Tomcat web server. We need to pass Example.class as an argument to the run method to
tell SpringApplication which is the primary Spring component. The args array is also
passed through to expose any command-line arguments.

11.4 Running the example

At this point our application should work. Since we have used the
spring-boot-starter-parent POM we have a useful run goal that we can use to start
the application. Type mvn spring-boot:run from the root project directory to start the
application:

If you open a web browser to localhost:8080 you should see the following output:

Hello World!

To gracefully exit the application hit ctrl-c.

11.5 Creating an executable jar

Let’s finish our example by creating a completely self-contained executable jar file that
we could run in production. Executable jars (sometimes called “fat jars”) are archives
containing your compiled classes along with all of the jar dependencies that your code
needs to run.

Executable jars and Java

Java does not provide any standard way to load nested jar files (i.e. jar files that are
themselves contained within a jar). This can be problematic if you are looking to
distribute a self-contained application.

To solve this problem, many developers use “uber” jars. An uber jar simply packages
all classes, from all jars, into a single archive. The problem with this approach is that
it becomes hard to see which libraries you are actually using in your application. It can
also be problematic if the same filename is used (but with different content) in
multiple jars.

The spring-boot-starter-parent POM includes <executions> configuration to
bind the repackage goal. If you are not using the parent POM you will need to declare
this configuration yourself. See the plugin
documentation for details.

12. What to read next

Hopefully this section has provided you with some of the Spring Boot basics, and got you
on your way to writing your own applications. If you’re a task-oriented type of
developer you might want to jump over to spring.io and check out some of the
getting started guides that solve specific
“How do I do that with Spring” problems; we also have Spring Boot-specific
How-to reference documentation.

Part III. Using Spring Boot

This section goes into more detail about how you should use Spring Boot. It covers topics
such as build systems, auto-configuration and how to run your applications. We also cover
some Spring Boot best practices. Although there is nothing particularly special about
Spring Boot (it is just another library that you can consume), there are a few
recommendations that, when followed, will make your development process just a
little easier.

If you’re just starting out with Spring Boot, you should probably read the
Getting Started guide before diving into
this section.

13. Build systems

It is strongly recommended that you choose a build system that supports
dependency management, and one
that can consume artifacts published to the “Maven Central” repository. We
would recommend that you choose Maven or Gradle. It is possible to get Spring Boot to
work with other build systems (Ant for example), but they will not be particularly well
supported.

13.1 Dependency management

Each release of Spring Boot provides a curated list of dependencies it supports. In
practice, you do not need to provide a version for any of these dependencies in your
build configuration as Spring Boot is managing that for you. When you upgrade Spring
Boot itself, these dependencies will be upgraded as well in a consistent way.

Note

You can still specify a version and override Spring Boot’s recommendations if you
feel that’s necessary.

On the last point: since the default config files accept
Spring style placeholders (${…​}) the Maven filtering is changed to
use @..@ placeholders (you can override that with a Maven property
resource.delimiter).

13.2.1 Inheriting the starter parent

To configure your project to inherit from the spring-boot-starter-parent simply set
the parent:

You should only need to specify the Spring Boot version number on this dependency.
If you import additional starters, you can safely omit the version number.

With that setup, you can also override individual dependencies by overriding a property
in your own project. For instance, to upgrade to another Spring Data release train you’d
add the following to your pom.xml.

13.2.2 Using Spring Boot without the parent POM

Not everyone likes inheriting from the spring-boot-starter-parent POM. You may have your
own corporate standard parent that you need to use, or you may just prefer to explicitly
declare all your Maven configuration.

If you don’t want to use the spring-boot-starter-parent, you can still keep the benefit
of the dependency management (but not the plugin management) by using a scope=import
dependency:

That setup does not allow you to override individual dependencies using a property as
explained above. To achieve the same result, you’d need to add an entry in the
dependencyManagement of your project before the spring-boot-dependencies
entry. For instance, to upgrade to another Spring Data release train you’d add the
following to your pom.xml.

13.3 Gradle

13.4 Ant

It is possible to build a Spring Boot project using Apache Ant+Ivy. The
spring-boot-antlib “AntLib” module is also available to help Ant create executable
jars.

To declare dependencies a typical ivy.xml file will look something like this:

<ivy-moduleversion="2.0"><infoorganisation="org.springframework.boot"module="spring-boot-sample-ant" /><configurations><confname="compile"description="everything needed to compile this module" /><confname="runtime"extends="compile"description="everything needed to run this module" /></configurations><dependencies><dependencyorg="org.springframework.boot"name="spring-boot-starter"rev="${spring-boot.version}"conf="compile" /></dependencies></ivy-module>

13.5 Starters

Starters are a set of convenient dependency descriptors that you can include in your
application. You get a one-stop-shop for all the Spring and related technology that you
need, without having to hunt through sample code and copy paste loads of dependency
descriptors. For example, if you want to get started using Spring and JPA for database
access, just include the spring-boot-starter-data-jpa dependency in your project, and
you are good to go.

The starters contain a lot of the dependencies that you need to get a project up and
running quickly and with a consistent, supported set of managed transitive dependencies.

What’s in a name

All official starters follow a similar naming pattern; spring-boot-starter-*,
where * is a particular type of application. This naming structure is intended to
help when you need to find a starter. The Maven integration in many IDEs allow you to
search dependencies by name. For example, with the appropriate Eclipse or STS plugin
installed, you can simply hit ctrl-space in the POM editor and type
“spring-boot-starter” for a complete list.

As explained in the Creating your own starter
section, third party starters should not start with spring-boot as it is reserved for
official Spring Boot artifacts. A third-party starter for acme will be typically named
acme-spring-boot-starter.

The following application starters are provided by Spring Boot under the
org.springframework.boot group:

For a list of additional community contributed starters, see the
README file in the
spring-boot-starters module on GitHub.

14. Structuring your code

Spring Boot does not require any specific code layout to work, however, there are some
best practices that help.

14.1 Using the “default” package

When a class doesn’t include a package declaration it is considered to be in the
“default package”. The use of the “default package” is generally discouraged, and
should be avoided. It can cause particular problems for Spring Boot applications that
use @ComponentScan, @EntityScan or @SpringBootApplication annotations, since every
class from every jar, will be read.

Tip

We recommend that you follow Java’s recommended package naming conventions
and use a reversed domain name (for example, com.example.project).

14.2 Locating the main application class

We generally recommend that you locate your main application class in a root package
above other classes. The @EnableAutoConfiguration annotation is often placed on your
main class, and it implicitly defines a base “search package” for certain items. For
example, if you are writing a JPA application, the package of the
@EnableAutoConfiguration annotated class will be used to search for @Entity items.

Using a root package also allows the @ComponentScan annotation to be used without
needing to specify a basePackage attribute. You can also use the
@SpringBootApplication annotation if your main class is in the root package.

15. Configuration classes

Spring Boot favors Java-based configuration. Although it is possible to use
SpringApplication with an XML sources, we generally recommend that your primary
source is a single @Configuration class. Usually the class that defines the main
method is also a good candidate as the primary @Configuration.

Tip

Many Spring configuration examples have been published on the Internet that use XML
configuration. Always try to use the equivalent Java-based configuration if possible.
Searching for Enable* annotations can be a good starting point.

15.1 Importing additional configuration classes

You don’t need to put all your @Configuration into a single class. The @Import
annotation can be used to import additional configuration classes. Alternatively, you
can use @ComponentScan to automatically pick up all Spring components, including
@Configuration classes.

15.2 Importing XML configuration

If you absolutely must use XML based configuration, we recommend that you still start
with a @Configuration class. You can then use an additional @ImportResource
annotation to load XML configuration files.

16. Auto-configuration

Spring Boot auto-configuration attempts to automatically configure your Spring
application based on the jar dependencies that you have added. For example, If
HSQLDB is on your classpath, and you have not manually configured any database
connection beans, then we will auto-configure an in-memory database.

You need to opt-in to auto-configuration by adding the @EnableAutoConfiguration or
@SpringBootApplication annotations to one of your @Configuration classes.

Tip

You should only ever add one @EnableAutoConfiguration annotation. We generally
recommend that you add it to your primary @Configuration class.

16.1 Gradually replacing auto-configuration

Auto-configuration is noninvasive, at any point you can start to define your own
configuration to replace specific parts of the auto-configuration. For example, if
you add your own DataSource bean, the default embedded database support will back away.

If you need to find out what auto-configuration is currently being applied, and why,
start your application with the --debug switch. This will enable debug logs for a
selection of core loggers and log an auto-configuration report to the console.

16.2 Disabling specific auto-configuration

If you find that specific auto-configure classes are being applied that you don’t want,
you can use the exclude attribute of @EnableAutoConfiguration to disable them.

If the class is not on the classpath, you can use the excludeName attribute of
the annotation and specify the fully qualified name instead. Finally, you can also
control the list of auto-configuration classes to exclude via the
spring.autoconfigure.exclude property.

Tip

You can define exclusions both at the annotation level and using the property.

17. Spring Beans and dependency injection

You are free to use any of the standard Spring Framework techniques to define your beans
and their injected dependencies. For simplicity, we often find that using @ComponentScan
to find your beans, in combination with @Autowired constructor injection works well.

If you structure your code as suggested above (locating your application class in a root
package), you can add @ComponentScan without any arguments. All of your application
components (@Component, @Service, @Repository, @Controller etc.) will be
automatically registered as Spring Beans.

Here is an example @Service Bean that uses constructor injection to obtain a
required RiskAssessor bean.

Notice how using constructor injection allows the riskAssessor field to be marked
as final, indicating that it cannot be subsequently changed.

18. Using the @SpringBootApplication annotation

Many Spring Boot developers always have their main class annotated with @Configuration,
@EnableAutoConfiguration and @ComponentScan. Since these annotations are so frequently
used together (especially if you follow the best practices
above), Spring Boot provides a convenient @SpringBootApplication alternative.

The @SpringBootApplication annotation is equivalent to using @Configuration,
@EnableAutoConfiguration and @ComponentScan with their default attributes:

@SpringBootApplication also provides aliases to customize the attributes of
@EnableAutoConfiguration and @ComponentScan.

19. Running your application

One of the biggest advantages of packaging your application as jar and using an embedded
HTTP server is that you can run your application as you would any other. Debugging Spring
Boot applications is also easy; you don’t need any special IDE plugins or extensions.

Note

This section only covers jar based packaging, If you choose to package your
application as a war file you should refer to your server and IDE documentation.

19.1 Running from an IDE

You can run a Spring Boot application from your IDE as a simple Java application, however,
first you will need to import your project. Import steps will vary depending on your IDE
and build system. Most IDEs can import Maven projects directly, for example Eclipse users
can select Import…​ → Existing Maven Projects from the File menu.

If you can’t directly import your project into your IDE, you may be able to generate IDE
metadata using a build plugin. Maven includes plugins for
Eclipse and
IDEA; Gradle offers plugins
for various IDEs.

Tip

If you accidentally run a web application twice you will see a “Port already in
use” error. STS users can use the Relaunch button rather than Run to ensure that
any existing instance is closed.

19.2 Running as a packaged application

If you use the Spring Boot Maven or Gradle plugins to create an executable jar you can
run your application using java -jar. For example:

$ java -jar target/myproject-0.0.1-SNAPSHOT.jar

It is also possible to run a packaged application with remote debugging support enabled.
This allows you to attach a debugger to your packaged application:

19.3 Using the Maven plugin

The Spring Boot Maven plugin includes a run goal which can be used to quickly compile
and run your application. Applications run in an exploded form just like in your IDE.

$ mvn spring-boot:run

You might also want to use the useful operating system environment variable:

$ export MAVEN_OPTS=-Xmx1024m

19.4 Using the Gradle plugin

The Spring Boot Gradle plugin also includes a bootRun task which can be used to run
your application in an exploded form. The bootRun task is added whenever you apply the
the org.springframework.boot and java plugins:

$ gradle bootRun

You might also want to use this useful operating system environment variable:

$ export JAVA_OPTS=-Xmx1024m

19.5 Hot swapping

Since Spring Boot applications are just plain Java applications, JVM hot-swapping should
work out of the box. JVM hot swapping is somewhat limited with the bytecode that it can
replace, for a more complete solution
JRebel can be used. The
spring-boot-devtools module also includes support for quick application restarts.

20. Developer tools

Spring Boot includes an additional set of tools that can make the application
development experience a little more pleasant. The spring-boot-devtools module can be
included in any project to provide additional development-time features. To include
devtools support, simply add the module dependency to your build:

Developer tools are automatically disabled when running a fully packaged
application. If your application is launched using java -jar or if it’s started using a
special classloader, then it is considered a “production application”. Flagging the
dependency as optional is a best practice that prevents devtools from being transitively
applied to other modules using your project. Gradle does not support optional
dependencies out-of-the-box so you may want to have a look to the
propdeps-plugin in the meantime.

Tip

repackaged archives do not contain devtools by default. If you want to use
certain remote devtools feature, you’ll need to disable the
excludeDevtools build property to include it. The property is supported with both the
Maven and Gradle plugins.

Whilst caching is very beneficial in production, it can be counter productive during
development, preventing you from seeing the changes you just made in your application.
For this reason, spring-boot-devtools will disable those caching options by default.

Cache options are usually configured by settings in your application.properties file.
For example, Thymeleaf offers the spring.thymeleaf.cache property. Rather than needing
to set these properties manually, the spring-boot-devtools module will automatically
apply sensible development-time configuration.

20.2 Automatic restart

Applications that use spring-boot-devtools will automatically restart whenever files
on the classpath change. This can be a useful feature when working in an IDE as it gives
a very fast feedback loop for code changes. By default, any entry on the classpath that
points to a folder will be monitored for changes. Note that certain resources such as
static assets and view templates do not need to
restart the application.

Triggering a restart

As DevTools monitors classpath resources, the only way to trigger a restart is to update
the classpath. The way in which you cause the classpath to be updated depends on the IDE
that you are using. In Eclipse, saving a modified file will cause the classpath to be
updated and trigger a restart. In IntelliJ IDEA, building the project (Build -> Make
Project) will have the same effect.

Note

You can also start your application via the supported build plugins (i.e. Maven and
Gradle) as long as forking is enabled since DevTools need an isolated application
classloader to operate properly. Gradle and Maven do that by default when they detect
DevTools on the classpath.

Tip

Automatic restart works very well when used with LiveReload.
See below for details. If you use JRebel automatic
restarts will be disabled in favor of dynamic class reloading. Other devtools features
(such as LiveReload and property overrides) can still be used.

Note

DevTools relies on the application context’s shutdown hook to close it during a
restart. It will not work correctly if you have disabled the shutdown hook (
SpringApplication.setRegisterShutdownHook(false)).

Note

When deciding if an entry on the classpath should trigger a restart when it changes,
DevTools automatically ignores projects named spring-boot, spring-boot-devtools,
spring-boot-autoconfigure, spring-boot-actuator, and spring-boot-starter.

Note

DevTools needs to customize the ResourceLoader used by the ApplicationContext:
if your application provides one already, it is going to be wrapped. Direct override of
the getResource method on the ApplicationContext is not supported.

Restart vs Reload

The restart technology provided by Spring Boot works by using two classloaders.
Classes that don’t change (for example, those from third-party jars) are loaded into a
base classloader. Classes that you’re actively developing are loaded into a restart
classloader. When the application is restarted, the restart classloader is thrown away
and a new one is created. This approach means that application restarts are typically much
faster than “cold starts” since the base classloader is already available and
populated.

If you find that restarts aren’t quick enough for your applications, or you encounter
classloading issues, you could consider reloading technologies such as
JRebel from ZeroTurnaround. These work by
rewriting classes as they are loaded to make them more amenable to reloading.

20.2.1 Excluding resources

Certain resources don’t necessarily need to trigger a restart when they are changed. For
example, Thymeleaf templates can just be edited in-place. By default changing resources
in /META-INF/maven, /META-INF/resources ,/resources ,/static ,/public or
/templates will not trigger a restart but will trigger a
live reload. If you want to customize these exclusions
you can use the spring.devtools.restart.exclude property. For example, to exclude only
/static and /public you would set the following:

spring.devtools.restart.exclude=static/**,public/**

Tip

if you want to keep those defaults and add additional exclusions, use the
spring.devtools.restart.additional-exclude property instead.

20.2.2 Watching additional paths

You may want your application to be restarted or reloaded when you make changes to files
that are not on the classpath. To do so, use the
spring.devtools.restart.additional-paths property to configure additional paths to watch
for changes. You can use the spring.devtools.restart.exclude property
described above to control whether changes
beneath the additional paths will trigger a full restart or just a
live reload.

20.2.3 Disabling restart

If you don’t want to use the restart feature you can disable it using the
spring.devtools.restart.enabled property. In most cases you can set this in your
application.properties (this will still initialize the restart classloader but it won’t
watch for file changes).

If you need to completely disable restart support, for example, because it doesn’t work
with a specific library, you need to set a System property before calling
SpringApplication.run(…​). For example:

20.2.4 Using a trigger file

If you work with an IDE that continuously compiles changed files, you might prefer to
trigger restarts only at specific times. To do this you can use a “trigger file”, which
is a special file that must be modified when you want to actually trigger a restart check.
Changing the file only triggers the check and the restart will only occur if Devtools has
detected it has to do something. The trigger file could be updated manually, or via an IDE
plugin.

To use a trigger file use the spring.devtools.restart.trigger-file property.

Tip

You might want to set spring.devtools.restart.trigger-file as a
global setting so that all your projects behave
in the same way.

20.2.5 Customizing the restart classloader

As described in the Restart vs Reload section above, restart
functionality is implemented by using two classloaders. For most applications this
approach works well, however, sometimes it can cause classloading issues.

By default, any open project in your IDE will be loaded using the “restart” classloader,
and any regular .jar file will be loaded using the “base” classloader. If you work on
a multi-module project, and not each module is imported into your IDE, you may need to
customize things. To do this you can create a META-INF/spring-devtools.properties file.

The spring-devtools.properties file can contain restart.exclude. and
restart.include. prefixed properties. The include elements are items that should be
pulled up into the “restart” classloader, and the exclude elements are items that
should be pushed down into the “base” classloader. The value of the property is a regex
pattern that will be applied to the classpath.

All property keys must be unique. As long as a property starts with
restart.include. or restart.exclude. it will be considered.

Tip

All META-INF/spring-devtools.properties from the classpath will be loaded. You can
package files inside your project, or in the libraries that the project consumes.

20.2.6 Known limitations

Restart functionality does not work well with objects that are deserialized using a
standard ObjectInputStream. If you need to deserialize data, you may need to use Spring’s
ConfigurableObjectInputStream in combination with
Thread.currentThread().getContextClassLoader().

Unfortunately, several third-party libraries deserialize without considering the context
classloader. If you find such a problem, you will need to request a fix with the original
authors.

20.3 LiveReload

The spring-boot-devtools module includes an embedded LiveReload server that can be used
to trigger a browser refresh when a resource is changed. LiveReload browser extensions are
freely available for Chrome, Firefox and Safari from
livereload.com.

If you don’t want to start the LiveReload server when your application runs you can set
the spring.devtools.livereload.enabled property to false.

Note

You can only run one LiveReload server at a time. Before starting your application,
ensure that no other LiveReload servers are running. If you start multiple applications
from your IDE, only the first will have LiveReload support.

20.4 Global settings

You can configure global devtools settings by adding a file named
.spring-boot-devtools.properties to your $HOME folder (note that the filename starts
with “.”). Any properties added to this file will apply to all Spring Boot
applications on your machine that use devtools. For example, to configure restart to
always use a trigger file, you would add
the following:

~/.spring-boot-devtools.properties.

spring.devtools.reload.trigger-file=.reloadtrigger

20.5 Remote applications

The Spring Boot developer tools are not just limited to local development. You can also
use several features when running applications remotely. Remote support is opt-in, to
enable it you need to make sure that devtools is included in the repackaged archive:

Then you need to set a spring.devtools.remote.secret property, for example:

spring.devtools.remote.secret=mysecret

Warning

Enabling spring-boot-devtools on a remote application is a security risk. You
should never enable support on a production deployment.

Remote devtools support is provided in two parts; there is a server side endpoint that
accepts connections, and a client application that you run in your IDE. The server
component is automatically enabled when the spring.devtools.remote.secret property
is set. The client component must be launched manually.

20.5.1 Running the remote client application

The remote client application is designed to be run from within your IDE. You need to run
org.springframework.boot.devtools.RemoteSpringApplication using the same classpath as
the remote project that you’re connecting to. The non-option argument passed to the
application should be the remote URL that you are connecting to.

For example, if you are using Eclipse or STS, and you have a project named my-app that
you’ve deployed to Cloud Foundry, you would do the following:

Select Run Configurations…​ from the Run menu.

Create a new Java Application “launch configuration”.

Browse for the my-app project.

Use org.springframework.boot.devtools.RemoteSpringApplication as the main class.

Because the remote client is using the same classpath as the real application it
can directly read application properties. This is how the spring.devtools.remote.secret
property is read and passed to the server for authentication.

Tip

It’s always advisable to use https:// as the connection protocol so that traffic is
encrypted and passwords cannot be intercepted.

Tip

If you need to use a proxy to access the remote application, configure the
spring.devtools.remote.proxy.host and spring.devtools.remote.proxy.port properties.

20.5.2 Remote update

The remote client will monitor your application classpath for changes in the same way as
the local restart. Any updated resource will be pushed
to the remote application and (if required) trigger a restart. This can be quite helpful
if you are iterating on a feature that uses a cloud service that you don’t have locally.
Generally remote updates and restarts are much quicker than a full rebuild and deploy
cycle.

Note

Files are only monitored when the remote client is running. If you change a file
before starting the remote client, it won’t be pushed to the remote server.

20.5.3 Remote debug tunnel

Java remote debugging is useful when diagnosing issues on a remote application.
Unfortunately, it’s not always possible to enable remote debugging when your application
is deployed outside of your data center. Remote debugging can also be tricky to setup if
you are using a container based technology such as Docker.

To help work around these limitations, devtools supports tunneling of remote debug traffic
over HTTP. The remote client provides a local server on port 8000 that you can attach
a remote debugger to. Once a connection is established, debug traffic is sent over HTTP
to the remote application. You can use the spring.devtools.remote.debug.local-port
property if you want to use a different port.

You’ll need to ensure that your remote application is started with remote debugging
enabled. Often this can be achieved by configuring JAVA_OPTS. For example, with
Cloud Foundry you can add the following to your manifest.yml:

Notice that you don’t need to pass an address=NNNN option to -Xrunjdwp. If
omitted Java will simply pick a random free port.

Note

Debugging a remote service over the Internet can be slow and you might need to
increase timeouts in your IDE. For example, in Eclipse you can select Java → Debug
from Preferences…​ and change the Debugger timeout (ms) to a more suitable value
(60000 works well in most situations).

Warning

When using the remote debug tunnel with IntelliJ IDEA, all breakpoints must be
configured to suspend the thread rather than the VM. By default, breakpoints in IntelliJ
IDEA suspend the entire VM rather than only suspending the thread that hit the
breakpoint. This has the unwanted side-effect of suspending the thread that manages the
remote debug tunnel, causing your debugging session to freeze. When using the remote
debug tunnel with IntelliJ IDEA, all breakpoints should be configured to suspend the
thread rather than the VM. Please see
IDEA-165769 for further details.

21. Packaging your application for production

Executable jars can be used for production deployment. As they are self-contained, they
are also ideally suited for cloud-based deployment.

22. What to read next

You should now have good understanding of how you can use Spring Boot along with some best
practices that you should follow. You can now go on to learn about specific
Spring Boot features in depth, or you
could skip ahead and read about the
“production ready” aspects of Spring
Boot.

Part IV. Spring Boot features

This section dives into the details of Spring Boot. Here you can learn about the key
features that you will want to use and customize. If you haven’t already, you might want
to read the Part II, “Getting started” and
Part III, “Using Spring Boot” sections so that you have a good grounding
of the basics.

23. SpringApplication

The SpringApplication class provides a convenient way to bootstrap a Spring application
that will be started from a main() method. In many situations you can just delegate to
the static SpringApplication.run method:

By default INFO logging messages will be shown, including some relevant startup details
such as the user that launched the application.

23.1 Startup failure

If your application fails to start, registered FailureAnalyzers get a chance to provide
a dedicated error message and a concrete action to fix the problem. For instance if you
start a web application on port 8080 and that port is already in use, you should see
something similar to the following:

***************************
APPLICATION FAILED TO START
***************************
Description:
Embedded servlet container failed to start. Port 8080 was already in use.
Action:
Identify and stop the process that's listening on port 8080 or configure this application to listen on another port.

Note

Spring Boot provides numerous FailureAnalyzer implementations and you can
add your own very easily.

If no failure analyzers are able to handle the exception, you can still display the full
auto-configuration report to better understand what went wrong. To do so you need to
enable the debug property or
enable DEBUG logging for
org.springframework.boot.autoconfigure.logging.AutoConfigurationReportLoggingInitializer.

For instance, if you are running your application using java -jar you can enable the
debug property as follows:

$ java -jar myproject-0.0.1-SNAPSHOT.jar --debug

23.2 Customizing the Banner

The banner that is printed on start up can be changed by adding a banner.txt file
to your classpath, or by setting banner.location to the location of such a file.
If the file has an unusual encoding you can set banner.charset (default is UTF-8).
In addition to a text file, you can also add a banner.gif, banner.jpg or banner.png
image file to your classpath, or set a banner.image.location property. Images will be
converted into an ASCII art representation and printed above any text banner.

Inside your banner.txt file you can use any of the following placeholders:

Table 23.1. Banner variables

Variable

Description

${application.version}

The version number of your application as declared in MANIFEST.MF. For example
Implementation-Version: 1.0 is printed as 1.0.

${application.formatted-version}

The version number of your application as declared in MANIFEST.MF formatted for
display (surrounded with brackets and prefixed with v). For example (v1.0).

${spring-boot.version}

The Spring Boot version that you are using. For example 2.0.0.M2.

${spring-boot.formatted-version}

The Spring Boot version that you are using formatted for display (surrounded with
brackets and prefixed with v). For example (v2.0.0.M2).

The constructor arguments passed to SpringApplication are configuration sources
for spring beans. In most cases these will be references to @Configuration classes, but
they could also be references to XML configuration or to packages that should be scanned.

There are some restrictions when creating an ApplicationContext hierarchy, e.g.
Web components must be contained within the child context, and the same Environment
will be used for both parent and child contexts. See the
SpringApplicationBuilder
Javadoc for full details.

23.5 Application events and listeners

In addition to the usual Spring Framework events, such as
ContextRefreshedEvent,
a SpringApplication sends some additional application events.

Note

Some events are actually triggered before the ApplicationContext is created so you
cannot register a listener on those as a @Bean. You can register them via the
SpringApplication.addListeners(…​) or SpringApplicationBuilder.listeners(…​)
methods.

If you want those listeners to be registered automatically regardless of the way the
application is created you can add a META-INF/spring.factories file to your project
and reference your listener(s) using the org.springframework.context.ApplicationListener
key.

Application events are sent in the following order, as your application runs:

An ApplicationStartingEvent is sent at the start of a run, but before any
processing except the registration of listeners and initializers.

An ApplicationEnvironmentPreparedEvent is sent when the Environment to be used in
the context is known, but before the context is created.

An ApplicationPreparedEvent is sent just before the refresh is started, but after bean
definitions have been loaded.

An ApplicationReadyEvent is sent after the refresh and any related callbacks have
been processed to indicate the application is ready to service requests.

An ApplicationFailedEvent is sent if there is an exception on startup.

Tip

You often won’t need to use application events, but it can be handy to know that they
exist. Internally, Spring Boot uses events to handle a variety of tasks.

23.6 Web environment

A SpringApplication will attempt to create the right type of ApplicationContext on
your behalf. By default, an AnnotationConfigApplicationContext or
AnnotationConfigServletWebServerApplicationContext will be used, depending on whether you
are developing a web application or not.

The algorithm used to determine a ‘web environment’ is fairly simplistic (based on the
presence of a few classes). You can use setWebEnvironment(boolean webEnvironment) if
you need to override the default.

It is also possible to take complete control of the ApplicationContext type that will
be used by calling setApplicationContextClass(…​).

Tip

It is often desirable to call setWebEnvironment(false) when using
SpringApplication within a JUnit test.

23.7 Accessing application arguments

If you need to access the application arguments that were passed to
SpringApplication.run(…​) you can inject a
org.springframework.boot.ApplicationArguments bean. The ApplicationArguments interface
provides access to both the raw String[] arguments as well as parsed option and
non-option arguments:

Spring Boot will also register a CommandLinePropertySource with the Spring
Environment. This allows you to also inject single application arguments using the
@Value annotation.

23.8 Using the ApplicationRunner or CommandLineRunner

If you need to run some specific code once the SpringApplication has started, you can
implement the ApplicationRunner or CommandLineRunner interfaces. Both interfaces work
in the same way and offer a single run method which will be called just before
SpringApplication.run(…​) completes.

You can additionally implement the org.springframework.core.Ordered interface or use the
org.springframework.core.annotation.Order annotation if several CommandLineRunner or
ApplicationRunner beans are defined that must be called in a specific order.

23.9 Application exit

Each SpringApplication will register a shutdown hook with the JVM to ensure that the
ApplicationContext is closed gracefully on exit. All the standard Spring lifecycle
callbacks (such as the DisposableBean interface, or the @PreDestroy annotation) can
be used.

In addition, beans may implement the org.springframework.boot.ExitCodeGenerator
interface if they wish to return a specific exit code when the application ends.

23.10 Admin features

It is possible to enable admin-related features for the application by specifying the
spring.application.admin.enabled property. This exposes the
SpringApplicationAdminMXBean
on the platform MBeanServer. You could use this feature to administer your Spring Boot
application remotely. This could also be useful for any service wrapper implementation.

Tip

If you want to know on which HTTP port the application is running, get the property
with key local.server.port.

Note

Take care when enabling this feature as the MBean exposes a method to shutdown the
application.

24. Externalized Configuration

Spring Boot allows you to externalize your configuration so you can work with the same
application code in different environments. You can use properties files, YAML files,
environment variables and command-line arguments to externalize configuration. Property
values can be injected directly into your beans using the @Value annotation, accessed
via Spring’s Environment abstraction or
bound to structured objects
via @ConfigurationProperties.

Spring Boot uses a very particular PropertySource order that is designed to allow
sensible overriding of values. Properties are considered in the following order:

On your application classpath (e.g. inside your jar) you can have an
application.properties that provides a sensible default property value for name. When
running in a new environment, an application.properties can be provided outside of your
jar that overrides the name; and for one-off testing, you can launch with a specific
command line switch (e.g. java -jar app.jar --name="Spring").

Tip

The SPRING_APPLICATION_JSON properties can be supplied on the
command line with an environment variable. For example in a
UN*X shell:

The random.int* syntax is OPEN value (,max) CLOSE where the OPEN,CLOSE are any
character and value,max are integers. If max is provided then value is the minimum
value and max is the maximum (exclusive).

24.2 Accessing command line properties

By default SpringApplication will convert any command line option arguments (starting
with ‘--’, e.g. --server.port=9000) to a property and add it to the Spring
Environment. As mentioned above, command line properties always take precedence over
other property sources.

If you don’t want command line properties to be added to the Environment you can disable
them using SpringApplication.setAddCommandLineProperties(false).

24.3 Application property files

SpringApplication will load properties from application.properties files in the
following locations and add them to the Spring Environment:

A /config subdirectory of the current directory.

The current directory

A classpath /config package

The classpath root

The list is ordered by precedence (properties defined in locations higher in the list
override those defined in lower locations).

If you don’t like application.properties as the configuration file name you can switch
to another by specifying a spring.config.name environment property. You can also refer
to an explicit location using the spring.config.location environment property
(comma-separated list of directory locations, or file paths).

spring.config.name and spring.config.location are used very early to
determine which files have to be loaded so they have to be defined as an environment
property (typically OS env, system property or command line argument).

If spring.config.location contains directories (as opposed to files) they should end
in / (and will be appended with the names generated from spring.config.name before
being loaded, including profile-specific file names). Files specified in
spring.config.location are used as-is, with no support for profile-specific variants,
and will be overridden by any profile-specific properties.

The default search path classpath:,classpath:/config,file:,file:config/
is always used, irrespective of the value of spring.config.location. This search path
is ordered from lowest to highest precedence (file:config/ wins). If you do specify
your own locations, they take precedence over all of the default locations and use the
same lowest to highest precedence ordering. In that way you can set up default values for
your application in application.properties (or whatever other basename you choose with
spring.config.name) and override it at runtime with a different file, keeping the
defaults.

Note

If you use environment variables rather than system properties, most operating
systems disallow period-separated key names, but you can use underscores instead (e.g.
SPRING_CONFIG_NAME instead of spring.config.name).

Note

If you are running in a container then JNDI properties (in java:comp/env) or
servlet context initialization parameters can be used instead of, or as well as,
environment variables or system properties.

24.4 Profile-specific properties

In addition to application.properties files, profile-specific properties can also be
defined using the naming convention application-{profile}.properties. The
Environment has a set of default profiles (by default [default]) which are
used if no active profiles are set (i.e. if no profiles are explicitly activated
then properties from application-default.properties are loaded).

Profile-specific properties are loaded from the same locations as standard
application.properties, with profile-specific files always overriding the non-specific
ones irrespective of whether the profile-specific files are inside or outside your
packaged jar.

If several profiles are specified, a last wins strategy applies. For example, profiles
specified by the spring.profiles.active property are added after those configured via
the SpringApplication API and therefore take precedence.

Note

If you have specified any files in spring.config.location, profile-specific
variants of those files will not be considered. Use directories in
spring.config.location if you also want to also use profile-specific properties.

24.5 Placeholders in properties

The values in application.properties are filtered through the existing Environment
when they are used so you can refer back to previously defined values (e.g. from System
properties).

24.6 Using YAML instead of Properties

YAML is a superset of JSON, and as such is a very convenient format
for specifying hierarchical configuration data. The SpringApplication class will
automatically support YAML as an alternative to properties whenever you have the
SnakeYAML library on your classpath.

Note

If you use ‘Starters’ SnakeYAML will be automatically provided via
spring-boot-starter.

24.6.1 Loading YAML

Spring Framework provides two convenient classes that can be used to load YAML documents.
The YamlPropertiesFactoryBean will load YAML as Properties and the
YamlMapFactoryBean will load YAML as a Map.

YAML lists are represented as property keys with [index] dereferencers,
for example this YAML:

my:
servers:
- dev.bar.com
- foo.bar.com

Would be transformed into these properties:

my.servers[0]=dev.bar.com
my.servers[1]=foo.bar.com

To bind to properties like that using the Spring DataBinder utilities (which is what
@ConfigurationProperties does) you need to have a property in the target bean of type
java.util.List (or Set) and you either need to provide a setter, or initialize it
with a mutable value, e.g. this will bind to the properties above

Extra care is required when configuring lists that way as overriding will not work as you
would expect. In the example above, when my.servers is redefined in several places, the
individual elements are targeted for override, not the list. To make sure that a
PropertySource with higher precedence can override the list, you need to define it as
a single property:

my:
servers: dev.bar.com,foo.bar.com

24.6.2 Exposing YAML as properties in the Spring Environment

The YamlPropertySourceLoader class can be used to expose YAML as a PropertySource
in the Spring Environment. This allows you to use the familiar @Value annotation with
placeholders syntax to access YAML properties.

24.6.3 Multi-profile YAML documents

You can specify multiple profile-specific YAML documents in a single file by
using a spring.profiles key to indicate when the document applies. For example:

In the example above, the server.address property will be 127.0.0.1 if the
development profile is active. If the development and production profiles are not
enabled, then the value for the property will be 192.168.1.100.

The default profiles are activated if none are explicitly active when the application
context starts. So in this YAML we set a value for security.user.password that is
only available in the "default" profile:

whereas in this example, the password is always set because it isn’t attached to any
profile, and it would have to be explicitly reset in all other profiles as necessary:

server:
port: 8000security:
user:
password: weak

Spring profiles designated using the "spring.profiles" element may optionally be negated
using the ! character. If both negated and non-negated profiles are specified for
a single document, at least one non-negated profile must match and no negated profiles
may match.

24.6.4 YAML shortcomings

YAML files can’t be loaded via the @PropertySource annotation. So in the
case that you need to load values that way, you need to use a properties file.

24.6.5 Merging YAML lists

As we have seen above, any YAML content is
ultimately transformed to properties. That process may be counter intuitive when
overriding “list” properties via a profile.

For example, assume a MyPojo object with name and description attributes
that are null by default. Let’s expose a list of MyPojo from FooProperties:

If the dev profile isn’t active, FooProperties.list will contain one MyPojo entry
as defined above. If the dev profile is enabled however, the list will still
only contain one entry (with name “my another name” and description null). This
configuration will not add a second MyPojo instance to the list, and it won’t merge
the items.

When a collection is specified in multiple profiles, the one with highest priority is
used (and only that one):

In the example above, considering that the dev profile is active, FooProperties.list
will contain oneMyPojo entry (with name “my another name” and description null).

24.7 Type-safe Configuration Properties

Using the @Value("${property}") annotation to inject configuration properties can
sometimes be cumbersome, especially if you are working with multiple properties or your
data is hierarchical in nature. Spring Boot provides an alternative method of working with
properties that allows strongly typed beans to govern and validate the configuration of
your application.

foo.security.username, with a nested "security" whose name is determined by the name
of the property. In particular the return type is not used at all there and could have
been SecurityProperties

foo.security.password

foo.security.roles, with a collection of String

Note

Getters and setters are usually mandatory, since binding is via standard Java Beans
property descriptors, just like in Spring MVC. There are cases where a setter may be
omitted:

Maps, as long as they are initialized, need a getter but not necessarily a setter since
they can be mutated by the binder.

Collections and arrays can be either accessed via an index (typically with YAML) or
using a single comma-separated value (properties). In the latter case, a setter is
mandatory. We recommend to always add a setter for such types. If you initialize a
collection, make sure it is not immutable (as in the example above)

If nested POJO properties are initialized (like the Security field in the example
above), a setter is not required. If you want the binder to create the instance on-the-fly
using its default constructor, you will need a setter.

Some people use Project Lombok to add getters and setters automatically. Make sure that
Lombok doesn’t generate any particular constructor for such type as it will be used
automatically by the container to instantiate the object.

When @ConfigurationProperties bean is registered that way, the bean will have a
conventional name: <prefix>-<fqn>, where <prefix> is the environment key prefix
specified in the @ConfigurationProperties annotation and <fqn> the fully qualified
name of the bean. If the annotation does not provide any prefix, only the fully qualified
name of the bean is used.

The bean name in the example above will be foo-com.example.FooProperties.

Even if the configuration above will create a regular bean for FooProperties, we
recommend that @ConfigurationProperties only deal with the environment and in particular
does not inject other beans from the context. Having said that, The
@EnableConfigurationProperties annotation is also automatically applied to your project
so that any existing bean annotated with @ConfigurationProperties will be configured
from the Environment. You could shortcut MyConfiguration above by making sure
FooProperties is a already a bean:

Using @ConfigurationProperties also allows you to generate meta-data files that can
be used by IDEs to offer auto-completion for your own keys, see the
Appendix B, Configuration meta-data appendix for details.

24.7.1 Third-party configuration

As well as using @ConfigurationProperties to annotate a class, you can also use it
on public @Bean methods. This can be particularly useful when you want to bind
properties to third-party components that are outside of your control.

To configure a bean from the Environment properties, add @ConfigurationProperties to
its bean registration:

Any property defined with the bar prefix will be mapped onto that BarComponent bean
in a similar manner as the FooProperties example above.

24.7.2 Relaxed binding

Spring Boot uses some relaxed rules for binding Environment properties to
@ConfigurationProperties beans, so there doesn’t need to be an exact match between
the Environment property name and the bean property name. Common examples where this
is useful include dashed separated (e.g. context-path binds to contextPath), and
capitalized (e.g. PORT binds to port) environment properties.

Underscore notation, alternative format for use in .properties and .yml files.

PERSON_FIRST_NAME

Upper case format. Recommended when using a system environment variables.

24.7.3 Properties conversion

Spring will attempt to coerce the external application properties to the right type when
it binds to the @ConfigurationProperties beans. If you need custom type conversion you
can provide a ConversionService bean (with bean id conversionService) or custom
property editors (via a CustomEditorConfigurer bean) or custom Converters (with
bean definitions annotated as @ConfigurationPropertiesBinding).

Note

As this bean is requested very early during the application lifecycle, make sure to
limit the dependencies that your ConversionService is using. Typically, any dependency
that you require may not be fully initialized at creation time. You may want to rename
your custom ConversionService if it’s not required for configuration keys coercion and
only rely on custom converters qualified with @ConfigurationPropertiesBinding.

24.7.4 @ConfigurationProperties Validation

Spring Boot will attempt to validate @ConfigurationProperties classes whenever they
are annotated with Spring’s @Validated annotation. You can use JSR-303 javax.validation
constraint annotations directly on your configuration class. Simply ensure that a
compliant JSR-303 implementation is on your classpath, then add constraint annotations to
your fields:

You can also add a custom Spring Validator by creating a bean definition called
configurationPropertiesValidator. The @Bean method should be declared static. The
configuration properties validator is created very early in the application’s lifecycle
and declaring the @Bean method as static allows the bean to be created without having to
instantiate the @Configuration class. This avoids any problems that may be caused by
early instantiation. There is a
property
validation sample so you can see how to set things up.

Tip

The spring-boot-actuator module includes an endpoint that exposes all
@ConfigurationProperties beans. Simply point your web browser to /configprops
or use the equivalent JMX endpoint. See the
Production ready features.
section for details.

24.7.5 @ConfigurationProperties vs. @Value

@Value is a core container feature and it does not provide the same features as
type-safe Configuration Properties. The table below summarizes the features that are
supported by @ConfigurationProperties and @Value:

If you define a set of configuration keys for your own components, we recommend you to
group them in a POJO annotated with @ConfigurationProperties. Please also be aware
that since @Value does not support relaxed binding, it isn’t a great candidate if you
need to provide the value using environment variables.

25. Profiles

Spring Profiles provide a way to segregate parts of your application configuration and
make it only available in certain environments. Any @Component or @Configuration can
be marked with @Profile to limit when it is loaded:

In the normal Spring way, you can use a spring.profiles.activeEnvironment property to specify which profiles are active. You can
specify the property in any of the usual ways, for example you could
include it in your application.properties:

spring.profiles.active=dev,hsqldb

or specify on the command line using the switch --spring.profiles.active=dev,hsqldb.

25.1 Adding active profiles

The spring.profiles.active property follows the same ordering rules as other
properties, the highest PropertySource will win. This means that you can specify
active profiles in application.properties then replace them using the command line
switch.

Sometimes it is useful to have profile-specific properties that add to the active
profiles rather than replace them. The spring.profiles.include property can be used
to unconditionally add active profiles. The SpringApplication entry point also has
a Java API for setting additional profiles (i.e. on top of those activated by the
spring.profiles.active property): see the setAdditionalProfiles() method.

For example, when an application with following properties is run using the switch
--spring.profiles.active=prod the proddb and prodmq profiles will also be activated:

25.2 Programmatically setting profiles

You can programmatically set active profiles by calling
SpringApplication.setAdditionalProfiles(…​) before your application runs. It is also
possible to activate profiles using Spring’s ConfigurableEnvironment interface.

25.3 Profile-specific configuration files

Profile-specific variants of both application.properties (or application.yml) and
files referenced via @ConfigurationProperties are considered as files are loaded.
See Section 24.4, “Profile-specific properties” for details.

26. Logging

Spring Boot uses Commons Logging for all internal
logging, but leaves the underlying log implementation open. Default configurations are
provided for
Java Util Logging,
Log4J2 and Logback. In each
case loggers are pre-configured to use console output with optional file output also
available.

By default, If you use the ‘Starters’, Logback will be used for logging. Appropriate
Logback routing is also included to ensure that dependent libraries that use
Java Util Logging, Commons Logging, Log4J or SLF4J will all work correctly.

Tip

There are a lot of logging frameworks available for Java. Don’t worry if the above
list seems confusing. Generally you won’t need to change your logging dependencies and
the Spring Boot defaults will work just fine.

Thread name — Enclosed in square brackets (may be truncated for console output).

Logger name — This is usually the source class name (often abbreviated).

The log message.

Note

Logback does not have a FATAL level (it is mapped to ERROR)

26.2 Console output

The default log configuration will echo messages to the console as they are written. By
default ERROR, WARN and INFO level messages are logged. You can also enable a
“debug” mode by starting your application with a --debug flag.

$ java -jar myapp.jar --debug

Note

you can also specify debug=true in your application.properties.

When the debug mode is enabled, a selection of core loggers (embedded container, Hibernate
and Spring Boot) are configured to output more information. Enabling the debug mode does
not configure your application to log all messages with DEBUG level.

Alternatively, you can enable a “trace” mode by starting your application with a
--trace flag (or trace=true in your application.properties). This will enable trace
logging for a selection of core loggers (embedded container, Hibernate schema generation
and the whole Spring portfolio).

26.2.1 Color-coded output

If your terminal supports ANSI, color output will be used to aid readability. You can set
spring.output.ansi.enabled to a
supported value to override the auto
detection.

Color coding is configured using the %clr conversion word. In its simplest form the
converter will color the output according to the log level, for example:

%clr(%5p)

The mapping of log level to a color is as follows:

Level

Color

FATAL

Red

ERROR

Red

WARN

Yellow

INFO

Green

DEBUG

Green

TRACE

Green

Alternatively, you can specify the color or style that should be used by providing it
as an option to the conversion. For example, to make the text yellow:

%clr(%d{yyyy-MM-dd HH:mm:ss.SSS}){yellow}

The following colors and styles are supported:

blue

cyan

faint

green

magenta

red

yellow

26.3 File output

By default, Spring Boot will only log to the console and will not write log files. If you
want to write log files in addition to the console output you need to set a
logging.file or logging.path property (for example in your application.properties).

The following table shows how the logging.* properties can be used together:

Table 26.1. Logging properties

logging.file

logging.path

Example

Description

(none)

(none)

Console only logging.

Specific file

(none)

my.log

Writes to the specified log file. Names can be an exact location or relative to the
current directory.

(none)

Specific directory

/var/log

Writes spring.log to the specified directory. Names can be an exact location or
relative to the current directory.

Log files will rotate when they reach 10 MB and as with console output, ERROR, WARN
and INFO level messages are logged by default.

Note

The logging system is initialized early in the application lifecycle and as such
logging properties will not be found in property files loaded via @PropertySource
annotations.

Tip

Logging properties are independent of the actual logging infrastructure. As a
result, specific configuration keys (such as logback.configurationFile for Logback)
are not managed by spring Boot.

26.4 Log Levels

All the supported logging systems can have the logger levels set in the Spring
Environment (so for example in application.properties) using
‘logging.level.*=LEVEL’ where ‘LEVEL’ is one of TRACE, DEBUG, INFO, WARN, ERROR,
FATAL, OFF. The root logger can be configured using logging.level.root.
Example application.properties:

By default Spring Boot remaps Thymeleaf INFO messages so that they are logged at
DEBUG level. This helps to reduce noise in the standard log output. See
LevelRemappingAppender
for details of how you can apply remapping in your own configuration.

26.5 Custom log configuration

The various logging systems can be activated by including the appropriate libraries on
the classpath, and further customized by providing a suitable configuration file in the
root of the classpath, or in a location specified by the Spring Environment property
logging.config.

You can force Spring Boot to use a particular logging system using the
org.springframework.boot.logging.LoggingSystem system property. The value should be
the fully-qualified class name of a LoggingSystem implementation. You can also disable
Spring Boot’s logging configuration entirely by using a value of none.

Note

Since logging is initialized before the ApplicationContext is created, it isn’t
possible to control logging from @PropertySources in Spring @Configuration files.
System properties and the conventional Spring Boot external configuration files work just
fine.)

When possible we recommend that you use the -spring variants for your logging
configuration (for example logback-spring.xml rather than logback.xml). If you use
standard configuration locations, Spring cannot completely control log initialization.

Warning

There are known classloading issues with Java Util Logging that cause problems
when running from an ‘executable jar’. We recommend that you avoid it if at all
possible.

To help with the customization some other properties are transferred from the Spring
Environment to System properties:

Spring Environment

System Property

Comments

logging.exception-conversion-word

LOG_EXCEPTION_CONVERSION_WORD

The conversion word that’s used when logging exceptions.

logging.file

LOG_FILE

Used in default log configuration if defined.

logging.path

LOG_PATH

Used in default log configuration if defined.

logging.pattern.console

CONSOLE_LOG_PATTERN

The log pattern to use on the console (stdout). (Only supported with the default logback setup.)

logging.pattern.file

FILE_LOG_PATTERN

The log pattern to use in a file (if LOG_FILE enabled). (Only supported with the default logback setup.)

logging.pattern.level

LOG_LEVEL_PATTERN

The format to use to render the log level (default %5p). (Only supported with the default logback setup.)

PID

PID

The current process ID (discovered if possible and when not already defined as an OS
environment variable).

All the logging systems supported can consult System properties when parsing their
configuration files. See the default configurations in spring-boot.jar for examples.

Tip

If you want to use a placeholder in a logging property, you should use
Spring Boot’s syntax and not
the syntax of the underlying framework. Notably, if you’re using Logback, you should use
: as the delimiter between a property name and its default value and not :-.

Tip

You can add MDC and other ad-hoc content to log lines by overriding
only the LOG_LEVEL_PATTERN (or logging.pattern.level with
Logback). For example, if you use logging.pattern.level=user:%X{user}
%5p then the default log format will contain an MDC entry for "user"
if it exists, e.g.

26.6 Logback extensions

Spring Boot includes a number of extensions to Logback which can help with advanced
configuration. You can use these extensions in your logback-spring.xml configuration
file.

Note

You cannot use extensions in the standard logback.xml configuration file since
it’s loaded too early. You need to either use logback-spring.xml or define a
logging.config property.

Warning

The extensions cannot be used with Logback’s
configuration scanning. If you
attempt to do so, making changes to the configuration file will result in an error similar
to one of the following being logged:

ERROR in [email protected]:71 - no applicable action for [springProperty], current ElementPath is [[configuration][springProperty]]
ERROR in [email protected]:71 - no applicable action for [springProfile], current ElementPath is [[configuration][springProfile]]

26.6.1 Profile-specific configuration

The <springProfile> tag allows you to optionally include or exclude sections of
configuration based on the active Spring profiles. Profile sections are supported anywhere
within the <configuration> element. Use the name attribute to specify which profile
accepts the configuration. Multiple profiles can be specified using a comma-separated
list.

<springProfilename="staging"><!-- configuration to be enabled when the "staging" profile is active --></springProfile><springProfilename="dev, staging"><!-- configuration to be enabled when the "dev" or "staging" profiles are active --></springProfile><springProfilename="!production"><!-- configuration to be enabled when the "production" profile is not active --></springProfile>

26.6.2 Environment properties

The <springProperty> tag allows you to surface properties from the Spring Environment
for use within Logback. This can be useful if you want to access values from your
application.properties file in your logback configuration. The tag works in a similar
way to Logback’s standard <property> tag, but rather than specifying a direct value
you specify the source of the property (from the Environment). You can use the scope
attribute if you need to store the property somewhere other than in local scope. If
you need a fallback value in case the property is not set in the Environment, you can
use the defaultValue attribute.

The RelaxedPropertyResolver is used to access Environment properties. If specify
the source in dashed notation (my-property-name) all the relaxed variations will be
tried (myPropertyName, MY_PROPERTY_NAME etc).

27. Developing web applications

Spring Boot is well suited for web application development. You can easily create a
self-contained HTTP server using embedded Tomcat, Jetty, or Undertow. Most web
applications will use the spring-boot-starter-web module to get up and running quickly.

If you haven’t yet developed a Spring Boot web application you can follow the
"Hello World!" example in the
Getting started section.

Automatic use of a ConfigurableWebBindingInitializer bean (see below).

If you want to keep Spring Boot MVC features, and
you just want to add additional MVC configuration (interceptors,
formatters, view controllers etc.) you can add your own @Configuration class of type
WebMvcConfigurerAdapter, but without@EnableWebMvc. If you wish to provide custom
instances of RequestMappingHandlerMapping, RequestMappingHandlerAdapter or
ExceptionHandlerExceptionResolver you can declare a WebMvcRegistrationsAdapter
instance providing such components.

If you want to take complete control of Spring MVC, you can add your own @Configuration
annotated with @EnableWebMvc.

27.1.2 HttpMessageConverters

Spring MVC uses the HttpMessageConverter interface to convert HTTP requests and
responses. Sensible defaults are included out of the box, for example Objects can be
automatically converted to JSON (using the Jackson library) or XML (using the Jackson
XML extension if available, else using JAXB). Strings are encoded using UTF-8 by
default.

If you need to add or customize converters you can use Spring Boot’s
HttpMessageConverters class:

Any HttpMessageConverter bean that is present in the context will be added to the list
of converters. You can also override default converters that way.

27.1.3 Custom JSON Serializers and Deserializers

If you’re using Jackson to serialize and deserialize JSON data, you might want to write
your own JsonSerializer and JsonDeserializer classes. Custom serializers are usually
registered with Jackson via a Module,
but Spring Boot provides an alternative @JsonComponent annotation which makes it easier
to directly register Spring Beans.

You can use @JsonComponent directly on JsonSerializer or JsonDeserializer
implementations. You can also use it on classes that contains serializers/deserializers as
inner-classes. For example:

27.1.4 MessageCodesResolver

Spring MVC has a strategy for generating error codes for rendering error messages
from binding errors: MessageCodesResolver. Spring Boot will create one for you if
you set the spring.mvc.message-codes-resolver.format property PREFIX_ERROR_CODE or
POSTFIX_ERROR_CODE (see the enumeration in DefaultMessageCodesResolver.Format).

27.1.5 Static Content

By default Spring Boot will serve static content from a directory called /static (or
/public or /resources or /META-INF/resources) in the classpath or from the root
of the ServletContext. It uses the ResourceHttpRequestHandler from Spring MVC so you
can modify that behavior by adding your own WebMvcConfigurerAdapter and overriding the
addResourceHandlers method.

In a stand-alone web application the default servlet from the container is also
enabled, and acts as a fallback, serving content from the root of the ServletContext if
Spring decides not to handle it. Most of the time this will not happen (unless you modify
the default MVC configuration) because Spring will always be able to handle requests
through the DispatcherServlet.

By default, resources are mapped on /** but you can tune that via
spring.mvc.static-path-pattern. For instance, relocating all resources to /resources/**
can be achieved as follows:

spring.mvc.static-path-pattern=/resources/**

You can also customize the static resource locations using
spring.resources.static-locations (replacing the default values with a list of directory
locations). If you do this the default welcome page detection will switch to your custom
locations, so if there is an index.html in any of your locations on startup, it will be
the home page of the application.

In addition to the ‘standard’ static resource locations above, a special case is made
for Webjars content. Any resources with a path in /webjars/**
will be served from jar files if they are packaged in the Webjars format.

Tip

Do not use the src/main/webapp directory if your application will be packaged as a
jar. Although this directory is a common standard, it will only work with war packaging
and it will be silently ignored by most build tools if you generate a jar.

Spring Boot also supports advanced resource handling features provided by Spring MVC,
allowing use cases such as cache busting static resources or using version agnostic URLs
for Webjars.

To use version agnostic URLs for Webjars, simply add the webjars-locator dependency.
Then declare your Webjar, taking jQuery for example, as "/webjars/jquery/dist/jquery.min.js"
which results in "/webjars/jquery/x.y.z/dist/jquery.min.js" where x.y.z is the Webjar
version.

Note

If you are using JBoss, you’ll need to declare the webjars-locator-jboss-vfs
dependency instead of the webjars-locator; otherwise all Webjars resolve as a 404.

To use cache busting, the following configuration will configure a cache busting
solution for all static resources, effectively adding a content hash in URLs, such as
<link href="/css/spring-2a2d595e6ed9a0b24f027f2b63b134d6.css"/>:

Links to resources are rewritten at runtime in template, thanks to a
ResourceUrlEncodingFilter, auto-configured for Thymeleaf and FreeMarker. You should
manually declare this filter when using JSPs. Other template engines aren’t automatically
supported right now, but can be with custom template macros/helpers and the use of the
ResourceUrlProvider.

When loading resources dynamically with, for example, a JavaScript module loader, renaming
files is not an option. That’s why other strategies are also supported and can be combined.
A "fixed" strategy will add a static version string in the URL, without changing the file
name:

With this configuration, JavaScript modules located under "/js/lib/" will use a fixed
versioning strategy "/v12/js/lib/mymodule.js" while other resources will still use
the content one <link href="/css/spring-2a2d595e6ed9a0b24f027f2b63b134d6.css"/>.

27.1.6 Custom Favicon

Spring Boot looks for a favicon.ico in the configured static content locations and the
root of the classpath (in that order). If such file is present, it is automatically used
as the favicon of the application.

27.1.7 ConfigurableWebBindingInitializer

Spring MVC uses a WebBindingInitializer to initialize a WebDataBinder for a particular
request. If you create your own ConfigurableWebBindingInitializer@Bean, Spring Boot
will automatically configure Spring MVC to use it.

27.1.8 Template engines

As well as REST web services, you can also use Spring MVC to serve dynamic HTML content.
Spring MVC supports a variety of templating technologies including Thymeleaf, FreeMarker
and JSPs. Many other templating engines also ship their own Spring MVC integrations.

Spring Boot includes auto-configuration support for the following templating engines:

JSPs should be avoided if possible, there are several
known limitations when using them with embedded
servlet containers.

When you’re using one of these templating engines with the default configuration, your
templates will be picked up automatically from src/main/resources/templates.

Tip

IntelliJ IDEA orders the classpath differently depending on how you run your
application. Running your application in the IDE via its main method will result in a
different ordering to when you run your application using Maven or Gradle or from its
packaged jar. This can cause Spring Boot to fail to find the templates on the classpath.
If you’re affected by this problem you can reorder the classpath in the IDE to place the
module’s classes and resources first. Alternatively, you can configure the template prefix
to search every templates directory on the classpath: classpath*:/templates/.

27.1.9 Error Handling

Spring Boot provides an /error mapping by default that handles all errors in a sensible
way, and it is registered as a ‘global’ error page in the servlet container. For machine
clients it will produce a JSON response with details of the error, the HTTP status and the
exception message. For browser clients there is a ‘whitelabel’ error view that renders
the same data in HTML format (to customize it just add a View that resolves to
‘error’). To replace the default behaviour completely you can implement
ErrorController and register a bean definition of that type, or simply add a bean of
type ErrorAttributes to use the existing mechanism but replace the contents.

Tip

The BasicErrorController can be used as a base class for a custom ErrorController.
This is particularly useful if you want to add a handler for a new content type (the
default is to handle text/html specifically and provide a fallback for everything else).
To do that just extend BasicErrorController and add a public method with a
@RequestMapping that has a produces attribute, and create a bean of your new type.

You can also define a @ControllerAdvice to customize the JSON document to return for a
particular controller and/or exception type.

In the example above, if YourException is thrown by a controller defined in the same
package as FooController, a json representation of the CustomerErrorType POJO will be
used instead of the ErrorAttributes representation.

Custom error pages

If you want to display a custom HTML error page for a given status code, you add a file to
an /error folder. Error pages can either be static HTML (i.e. added under any of the
static resource folders) or built using templates. The name of the file should be the
exact status code or a series mask.

For example, to map 404 to a static HTML file, your folder structure would look like
this:

Mapping error pages outside of Spring MVC

For applications that aren’t using Spring MVC, you can use the ErrorPageRegistrar
interface to directly register ErrorPages. This abstraction works directly with the
underlying embedded servlet container and will work even if you don’t have a Spring MVC
DispatcherServlet.

N.B. if you register an ErrorPage with a path that will end up being handled by a
Filter (e.g. as is common with some non-Spring web frameworks, like Jersey and Wicket),
then the Filter has to be explicitly registered as an ERROR dispatcher, e.g.

(the default FilterRegistrationBean does not include the ERROR dispatcher type).

Error Handling on WebSphere Application Server

When deployed to a servlet container, a Spring Boot uses its error page filter to forward
a request with an error status to the appropriate error page. The request can only be
forwarded to the correct error page if the response has not already been committed. By
default, WebSphere Application Server 8.0 and later commits the response upon successful
completion of a servlet’s service method. You should disable this behaviour by setting
com.ibm.ws.webcontainer.invokeFlushAfterService to false

27.1.10 Spring HATEOAS

If you’re developing a RESTful API that makes use of hypermedia, Spring Boot provides
auto-configuration for Spring HATEOAS that works well with most applications. The
auto-configuration replaces the need to use @EnableHypermediaSupport and registers a
number of beans to ease building hypermedia-based applications including a
LinkDiscoverers (for client side support) and an ObjectMapper configured to correctly
marshal responses into the desired representation. The ObjectMapper will be customized
based on the spring.jackson.* properties or a Jackson2ObjectMapperBuilder bean if one
exists.

You can take control of Spring HATEOAS’s configuration by using
@EnableHypermediaSupport. Note that this will disable the ObjectMapper customization
described above.

27.2 JAX-RS and Jersey

If you prefer the JAX-RS programming model for REST endpoints you can use one of the
available implementations instead of Spring MVC. Jersey 1.x and Apache CXF work quite
well out of the box if you just register their Servlet or Filter as a @Bean in your
application context. Jersey 2.x has some native Spring support so we also provide
auto-configuration support for it in Spring Boot together with a starter.

To get started with Jersey 2.x just include the spring-boot-starter-jersey as a
dependency and then you need one @Bean of type ResourceConfig in which you register
all the endpoints:

Jersey’s support for scanning executable archives is rather limited. For example,
it cannot scan for endpoints in a package found in WEB-INF/classes when running an
executable war file. To avoid this limitation, the packages method should not be used
and endpoints should be registered individually using the register method as shown
above.

You can also register an arbitrary number of beans implementing ResourceConfigCustomizer
for more advanced customizations.

All the registered endpoints should be @Components with HTTP resource annotations
(@GET etc.), e.g.

Since the Endpoint is a Spring @Component its lifecycle is managed by Spring and you
can @Autowired dependencies and inject external configuration with @Value. The Jersey
servlet will be registered and mapped to /* by default. You can change the mapping
by adding @ApplicationPath to your ResourceConfig.

By default Jersey will be set up as a Servlet in a @Bean of type
ServletRegistrationBean named jerseyServletRegistration. By default, the servlet will
be initialized lazily but you can customize it with
spring.jersey.servlet.load-on-startup .You can disable or override that bean by creating
one of your own with the same name. You can also use a Filter instead of a Servlet by
setting spring.jersey.type=filter (in which case the @Bean to replace or override is
jerseyFilterRegistration). The servlet has an @Order which you can set with
spring.jersey.filter.order. Both the Servlet and the Filter registrations can be given
init parameters using spring.jersey.init.* to specify a map of properties.

There is a Jersey sample so
you can see how to set things up. There is also a
Jersey 1.x sample. Note that
in the Jersey 1.x sample that the spring-boot maven plugin has been configured to unpack
some Jersey jars so they can be scanned by the JAX-RS implementation (because the sample
asks for them to be scanned in its Filter registration). You may need to do the same if
any of your JAX-RS resources are packaged as nested jars.

27.3 Embedded servlet container support

Spring Boot includes support for embedded Tomcat, Jetty, and Undertow servers. Most
developers will simply use the appropriate ‘Starter’ to obtain a fully configured
instance. By default the embedded server will listen for HTTP requests on port 8080.

Warning

If you choose to use Tomcat on CentOS be aware that, by default, a temporary
directory is used to store compiled JSPs, file uploads etc. This directory may be
deleted by tmpwatch while your application is running leading to failures. To avoid
this, you may want to customize your tmpwatch configuration so that tomcat.*
directories are not deleted, or configure server.tomcat.basedir so that embedded Tomcat
uses a different location.

27.3.1 Servlets, Filters, and listeners

When using an embedded servlet container you can register Servlets, Filters and all the
listeners from the Servlet spec (e.g. HttpSessionListener) either by using Spring beans
or by scanning for Servlet components.

Registering Servlets, Filters, and listeners as Spring beans

Any Servlet, Filter or Servlet *Listener instance that is a Spring bean will be
registered with the embedded container. This can be particularly convenient if you want to
refer to a value from your application.properties during configuration.

By default, if the context contains only a single Servlet it will be mapped to /. In the
case of multiple Servlet beans the bean name will be used as a path prefix. Filters will
map to /*.

If convention-based mapping is not flexible enough you can use the
ServletRegistrationBean, FilterRegistrationBean and ServletListenerRegistrationBean
classes for complete control.

27.3.2 Servlet Context Initialization

Embedded servlet containers will not directly execute the Servlet 3.0+
javax.servlet.ServletContainerInitializer interface, or Spring’s
org.springframework.web.WebApplicationInitializer interface. This is an intentional
design decision intended to reduce the risk that 3rd party libraries designed to run
inside a war will break Spring Boot applications.

If you need to perform servlet context initialization in a Spring Boot application, you
should register a bean that implements the
org.springframework.boot.web.servlet.ServletContextInitializer interface. The
single onStartup method provides access to the ServletContext, and can easily be used
as an adapter to an existing WebApplicationInitializer if necessary.

Scanning for Servlets, Filters, and listeners

When using an embedded container, automatic registration of @WebServlet, @WebFilter,
and @WebListener annotated classes can be enabled using @ServletComponentScan.

Tip

@ServletComponentScan will have no effect in a standalone container, where the
container’s built-in discovery mechanisms will be used instead.

27.3.3 The ServletWebServerApplicationContext

Under the hood Spring Boot uses a new type of ApplicationContext for embedded servlet
container support. The ServletWebServerApplicationContext is a special type of
WebApplicationContext that bootstraps itself by searching for a single
ServletWebServerFactory bean. Usually a TomcatServletWebServerFactory,
JettyServletWebServerFactory, or UndertowServletWebServerFactory will
have been auto-configured.

Note

You usually won’t need to be aware of these implementation classes. Most
applications will be auto-configured and the appropriate ApplicationContext and
ServletWebServerFactory will be created on your behalf.

27.3.4 Customizing embedded servlet containers

Common servlet container settings can be configured using Spring Environment
properties. Usually you would define the properties in your application.properties
file.

Spring Boot tries as much as possible to expose common settings but this is not always
possible. For those cases, dedicated namespaces offer server-specific customizations (see
server.tomcat and server.undertow). For instance,
access logs can be configured with specific
features of the embedded servlet container.

Programmatic customization

If you need to configure your embedded servlet container programmatically you can
register a Spring bean that implements the WebServerFactoryCustomizer interface.
WebServerFactoryCustomizer provides access to the
ConfigurableServletWebServerFactory which includes numerous customization setter
methods. Dedicated variants exists for Tomcat, Jetty and Undertow.

Setters are provided for many configuration options. Several protected method
‘hooks’ are also provided should you need to do something more exotic. See the
source code documentation for details.

27.3.5 JSP limitations

When running a Spring Boot application that uses an embedded servlet container (and is
packaged as an executable archive), there are some limitations in the JSP support.

With Tomcat it should work if you use war packaging, i.e. an executable war will work,
and will also be deployable to a standard container (not limited to, but including
Tomcat). An executable jar will not work because of a hard coded file pattern in Tomcat.

With Jetty it should work if you use war packaging, i.e. an executable war will work,
and will also be deployable to any standard container.

28. Security

If Spring Security is on the classpath then web applications will be secure by default
with ‘basic’ authentication on all HTTP endpoints. To add method-level security to a web
application you can also add @EnableGlobalMethodSecurity with your desired settings.
Additional information can be found in the Spring
Security Reference.

The default AuthenticationManager has a single user (‘user’ username and random
password, printed at INFO level when the application starts up)

Using default security password: 78fa095d-3f4c-48b1-ad50-e24c31d5cf35

Note

If you fine-tune your logging configuration, ensure that the
org.springframework.boot.autoconfigure.security category is set to log INFO messages,
otherwise the default password will not be printed.

You can change the password by providing a security.user.password. This and other useful
properties are externalized via
SecurityProperties
(properties prefix "security").

The default security configuration is implemented in SecurityAutoConfiguration and in
the classes imported from there (SpringBootWebSecurityConfiguration for web security
and AuthenticationManagerConfiguration for authentication configuration which is also
relevant in non-web applications). To switch off the default web application security
configuration completely you can add a bean with @EnableWebSecurity (this does not
disable the authentication manager configuration or Actuator’s security). To customize
it you normally use external properties and beans of type WebSecurityConfigurerAdapter
(e.g. to add form-based login). To also switch off the authentication manager configuration
you can add a bean of type AuthenticationManager, or else configure the
global AuthenticationManager by autowiring an AuthenticationManagerBuilder into
a method in one of your @Configuration classes. There are several secure applications in
the Spring Boot samples to get you started with common
use cases.

The basic features you get out of the box in a web application are:

An AuthenticationManager bean with in-memory store and a single user (see
SecurityProperties.User for the properties of the user).

Security events published to Spring’s ApplicationEventPublisher (successful and
unsuccessful authentication and access denied).

Common low-level features (HSTS, XSS, CSRF, caching) provided by Spring Security are
on by default.

All of the above can be switched on and off or modified using external properties
(security.*). To override the access rules without changing any other auto-configured
features add a @Bean of type WebSecurityConfigurerAdapter with
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) and configure it to meet your needs.

Note

By default, a WebSecurityConfigurerAdapter will match any path. If you don’t want
to completely override Spring Boot’s auto-configured access rules, your adapter must
explicitly configure the paths that you do want to override.

28.1 OAuth2

If you have spring-security-oauth2 on your classpath you can take advantage of some
auto-configuration to make it easy to set up Authorization or Resource Server. For full
details, see the Spring Security OAuth 2 Developers
Guide.

28.1.1 Authorization Server

To create an Authorization Server and grant access tokens you need to use
@EnableAuthorizationServer and provide security.oauth2.client.client-id and
security.oauth2.client.client-secret] properties. The client will be registered for you
in an in-memory repository.

Having done that you will be able to use the client credentials to create an access token,
for example:

The basic auth credentials for the /token endpoint are the client-id and
client-secret. The user credentials are the normal Spring Security user details (which
default in Spring Boot to “user” and a random password).

To switch off the auto-configuration and configure the Authorization Server features
yourself just add a @Bean of type AuthorizationServerConfigurer.

28.1.2 Resource Server

To use the access token you need a Resource Server (which can be the same as the
Authorization Server). Creating a Resource Server is easy, just add
@EnableResourceServer and provide some configuration to allow the server to decode
access tokens. If your application is also an Authorization Server it already knows how
to decode tokens, so there is nothing else to do. If your app is a standalone service then you
need to give it some more configuration, one of the following options:

security.oauth2.resource.user-info-uri to use the /me resource (e.g.
https://uaa.run.pivotal.io/userinfo on PWS)

security.oauth2.resource.token-info-uri to use the token decoding endpoint (e.g.
https://uaa.run.pivotal.io/check_token on PWS).

If you specify both the user-info-uri and the token-info-uri then you can set a flag
to say that one is preferred over the other (prefer-token-info=true is the default).

Alternatively (instead of user-info-uri or token-info-uri) if the tokens are JWTs you
can configure a security.oauth2.resource.jwt.key-value to decode them locally (where the
key is a verification key). The verification key value is either a symmetric secret or
PEM-encoded RSA public key. If you don’t have the key and it’s public you can provide a
URI where it can be downloaded (as a JSON object with a “value” field) with
security.oauth2.resource.jwt.key-uri. E.g. on PWS:

If you use the security.oauth2.resource.jwt.key-uri the authorization server
needs to be running when your application starts up. It will log a warning if it can’t
find the key, and tell you what to do to fix it.

OAuth2 resources are protected by a filter chain with order
security.oauth2.resource.filter-order and the default is after the filter protecting the
actuator endpoints by default (so actuator endpoints will stay on HTTP Basic unless you
change the order).

28.2 Token Type in User Info

Google, and certain other 3rd party identity providers, are more strict about the token
type name that is sent in the headers to the user info endpoint. The default is “Bearer”
which suits most providers and matches the spec, but if you need to change it you can set
security.oauth2.resource.token-type.

28.3 Customizing the User Info RestTemplate

If you have a user-info-uri, the resource server features use an OAuth2RestTemplate
internally to fetch user details for authentication. This is provided as a @Bean of
type UserInfoRestTemplateFactory. The default should be fine for most providers, but
occasionally you might need to add additional interceptors, or change the request
authenticator (which is how the token gets attached to outgoing requests). To add a
customization just create a bean of type UserInfoRestTemplateCustomizer - it has a
single method that will be called after the bean is created but before it is initialized.
The rest template that is being customized here is only used internally to carry out
authentication. Alternatively, you could define your own UserInfoRestTemplateFactory@Bean to take full control.

Tip

To set an RSA key value in YAML use the “pipe” continuation marker to split it over
multiple lines (“|”) and remember to indent the key value (it’s a standard YAML
language feature). Example:

28.3.1 Client

To make your web-app into an OAuth2 client you can simply add @EnableOAuth2Client and
Spring Boot will create a OAuth2ClientContext and OAuth2ProtectedResourceDetails that
are necessary to create an OAuth2RestOperations. Spring Boot does not automatically
create such bean but you can easily create your own:

You may want to add a qualifier and review your configuration as more than one
RestTemplate may be defined in your application.

This configuration uses security.oauth2.client.* as credentials (the same as you might
be using in the Authorization Server), but in addition it will need to know the
authorization and token URIs in the Authorization Server. For example:

An application with this configuration will redirect to Github for authorization when you
attempt to use the OAuth2RestTemplate. If you are already signed into Github you won’t
even notice that it has authenticated. These specific credentials will only work if your
application is running on port 8080 (register your own client app in Github or other
provider for more flexibility).

To limit the scope that the client asks for when it obtains an access token you can set
security.oauth2.client.scope (comma separated or an array in YAML). By default the scope
is empty and it is up to Authorization Server to decide what the defaults should be,
usually depending on the settings in the client registration that it holds.

Note

There is also a setting for security.oauth2.client.client-authentication-scheme
which defaults to “header” (but you might need to set it to “form” if, like Github for
instance, your OAuth2 provider doesn’t like header authentication). In fact, the
security.oauth2.client.* properties are bound to an instance of
AuthorizationCodeResourceDetails so all its properties can be specified.

Tip

In a non-web application you can still create an OAuth2RestOperations and it
is still wired into the security.oauth2.client.* configuration. In this case it is a
“client credentials token grant” you will be asking for if you use it (and there is no
need to use @EnableOAuth2Client or @EnableOAuth2Sso). To prevent that infrastructure
to be defined, just remove the security.oauth2.client.client-id from your configuration
(or make it the empty string).

28.3.2 Single Sign On

An OAuth2 Client can be used to fetch user details from the provider (if such features are
available) and then convert them into an Authentication token for Spring Security.
The Resource Server above support this via the user-info-uri property This is the basis
for a Single Sign On (SSO) protocol based on OAuth2, and Spring Boot makes it easy to
participate by providing an annotation @EnableOAuth2Sso. The Github client above can
protect all its resources and authenticate using the Github /user/ endpoint, by adding
that annotation and declaring where to find the endpoint (in addition to the
security.oauth2.client.* configuration already listed above):

Since all paths are secure by default, there is no “home” page that you can show to
unauthenticated users and invite them to login (by visiting the /login path, or the
path specified by security.oauth2.sso.login-path).

To customize the access rules or paths to protect, so you can add a “home” page for
instance, @EnableOAuth2Sso can be added to a WebSecurityConfigurerAdapter and the
annotation will cause it to be decorated and enhanced with the necessary pieces to get
the /login path working. For example, here we simply allow unauthenticated access
to the home page at "/" and keep the default for everything else:

28.4 Actuator Security

The management endpoints are secure even if the application endpoints are insecure.

Security events are transformed into AuditEvent instances and published to the
AuditEventRepository.

The default user will have the ACTUATOR role as well as the USER role.

The Actuator security features can be modified using external properties
(management.security.*). To override the application access rules
add a @Bean of type WebSecurityConfigurerAdapter and use
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) if you don’t want to override
the actuator access rules, or @Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)
if you do want to override the actuator access rules.

29. Working with SQL databases

The Spring Framework provides extensive support for working with SQL databases. From
direct JDBC access using JdbcTemplate to complete ‘object relational mapping’
technologies such as Hibernate. Spring Data provides an additional level of functionality,
creating Repository implementations directly from interfaces and using conventions to
generate queries from your method names.

29.1 Configure a DataSource

Java’s javax.sql.DataSource interface provides a standard method of working with
database connections. Traditionally a DataSource uses a URL along with some
credentials to establish a database connection.

Tip

Check also the ‘How-to’ section for more
advanced examples, typically to take full control over the configuration of the
DataSource.

29.1.1 Embedded Database Support

It’s often convenient to develop applications using an in-memory embedded database.
Obviously, in-memory databases do not provide persistent storage; you will need to
populate your database when your application starts and be prepared to throw away
data when your application ends.

Spring Boot can auto-configure embedded H2,
HSQL and Derby databases. You don’t need
to provide any connection URLs, simply include a build dependency to the embedded database
that you want to use.

Note

If you are using this feature in your tests, you may notice that the same database is
reused by your whole test suite regardless of the number of application contexts that
you use. If you want to make sure that each context has a separate embedded database,
you should set spring.datasource.generate-unique-name to true.

You need a dependency on spring-jdbc for an embedded database to be
auto-configured. In this example it’s pulled in transitively via
spring-boot-starter-data-jpa.

Tip

If, for whatever reason, you do configure the connection URL for an embedded
database, care should be taken to ensure that the database’s automatic shutdown is
disabled. If you’re using H2 you should use DB_CLOSE_ON_EXIT=FALSE to do so. If you’re
using HSQLDB, you should ensure that shutdown=true is not used. Disabling the database’s
automatic shutdown allows Spring Boot to control when the database is closed, thereby
ensuring that it happens once access to the database is no longer needed.

29.1.2 Connection to a production database

Production database connections can also be auto-configured using a pooling DataSource.
Here’s the algorithm for choosing a specific implementation:

We prefer HikariCP for its performance and concurrency, so if that is available we
always choose it.

Otherwise, if the Tomcat pooling DataSource is available we will use it.

If neither HikariCP nor the Tomcat pooling datasource are available and if Commons
DBCP2 is available we will use it.

If you use the spring-boot-starter-jdbc or spring-boot-starter-data-jpa
‘starters’ you will automatically get a dependency to HikariCP.

Note

You can bypass that algorithm completely and specify the connection pool to use via
the spring.datasource.type property. This is especially important if you are running
your application in a Tomcat container as tomcat-jdbc is provided by default.

Tip

Additional connection pools can always be configured manually. If you define your
own DataSource bean, auto-configuration will not occur.

DataSource configuration is controlled by external configuration properties in
spring.datasource.*. For example, you might declare the following section in
application.properties:

You should at least specify the url using the spring.datasource.url property or
Spring Boot will attempt to auto-configure an embedded database.

Tip

You often won’t need to specify the driver-class-name since Spring boot can deduce
it for most databases from the url.

Note

For a pooling DataSource to be created we need to be able to verify that a valid
Driver class is available, so we check for that before doing anything. I.e. if you set
spring.datasource.driver-class-name=com.mysql.jdbc.Driver then that class has to be
loadable.

See DataSourceProperties
for more of the supported options. These are the standard options that work regardless of
the actual implementation. It is also possible to fine-tune implementation-specific
settings using their respective prefix (spring.datasource.hikari.*,
spring.datasource.tomcat.*, and spring.datasource.dbcp2.*). Refer to the
documentation of the connection pool implementation you are using for more details.

# Number of ms to wait before throwing an exception if no connection is available.spring.datasource.tomcat.max-wait=10000
# Maximum number of active connections that can be allocated from this pool at the same time.spring.datasource.tomcat.max-active=50
# Validate the connection before borrowing it from the pool.spring.datasource.tomcat.test-on-borrow=true

29.1.3 Connection to a JNDI DataSource

If you are deploying your Spring Boot application to an Application Server you might want
to configure and manage your DataSource using your Application Servers built-in features
and access it using JNDI.

The spring.datasource.jndi-name property can be used as an alternative to the
spring.datasource.url, spring.datasource.username and spring.datasource.password
properties to access the DataSource from a specific JNDI location. For example, the
following section in application.properties shows how you can access a JBoss AS defined
DataSource:

spring.datasource.jndi-name=java:jboss/datasources/customers

29.2 Using JdbcTemplate

Spring’s JdbcTemplate and NamedParameterJdbcTemplate classes are auto-configured and
you can @Autowire them directly into your own beans:

You can customize some properties of the template using the spring.jdbc.template.*
properties:

spring.jdbc.template.max-rows=500

Tip

The NamedParameterJdbcTemplate reuses the same JdbcTemplate instance behind the
scene. If more than one JdbcTemplate is defined and no primary candidate exists, the
NamedParameterJdbcTemplate is not auto-configured.

29.3 JPA and ‘Spring Data’

The Java Persistence API is a standard technology that allows you to ‘map’ objects to
relational databases. The spring-boot-starter-data-jpa POM provides a quick way to get
started. It provides the following key dependencies:

29.3.1 Entity Classes

Traditionally, JPA ‘Entity’ classes are specified in a persistence.xml file. With
Spring Boot this file is not necessary and instead ‘Entity Scanning’ is used. By default
all packages below your main configuration class (the one annotated with
@EnableAutoConfiguration or @SpringBootApplication) will be searched.

Any classes annotated with @Entity, @Embeddable or @MappedSuperclass will be
considered. A typical entity class would look something like this:

29.3.2 Spring Data JPA Repositories

Spring Data JPA repositories are interfaces that you can define to access data. JPA
queries are created automatically from your method names. For example, a CityRepository
interface might declare a findAllByState(String state) method to find all cities in a
given state.

For more complex queries you can annotate your method using Spring Data’s
Query annotation.

Spring Data repositories usually extend from the
Repository or
CrudRepository interfaces.
If you are using auto-configuration, repositories will be searched from the package
containing your main configuration class (the one annotated with
@EnableAutoConfiguration or @SpringBootApplication) down.

29.3.3 Creating and dropping JPA databases

By default, JPA databases will be automatically created only if you use an embedded
database (H2, HSQL or Derby). You can explicitly configure JPA settings using
spring.jpa.* properties. For example, to create and drop tables you can add the
following to your application.properties.

spring.jpa.hibernate.ddl-auto=create-drop

Note

Hibernate’s own internal property name for this (if you happen to remember it
better) is hibernate.hbm2ddl.auto. You can set it, along with other Hibernate native
properties, using spring.jpa.properties.* (the prefix is stripped before adding them
to the entity manager). Example:

By default the DDL execution (or validation) is deferred until the ApplicationContext
has started. There is also a spring.jpa.generate-ddl flag, but it is not used if
Hibernate autoconfig is active because the ddl-auto settings are more fine-grained.

29.3.4 Open EntityManager in View

If you are running a web application, Spring Boot will by default register
OpenEntityManagerInViewInterceptor
to apply the "Open EntityManager in View" pattern, i.e. to allow for lazy loading in web
views. If you don’t want this behavior you should set spring.jpa.open-in-view to
false in your application.properties.

29.4 Using H2’s web console

The H2 database provides a
browser-based console that
Spring Boot can auto-configure for you. The console will be auto-configured when the
following conditions are met:

If you are not using Spring Boot’s developer tools, but would still like to make use
of H2’s console, then you can do so by configuring the spring.h2.console.enabled
property with a value of true. The H2 console is only intended for use during
development so care should be taken to ensure that spring.h2.console.enabled is not set
to true in production.

29.4.1 Changing the H2 console’s path

By default the console will be available at /h2-console. You can customize the console’s
path using the spring.h2.console.path property.

29.4.2 Securing the H2 console

When Spring Security is on the classpath and basic auth is enabled, the H2 console will be
automatically secured using basic auth. The following properties can be used to customize
the security configuration:

security.user.role

security.basic.authorize-mode

security.basic.enabled

29.5 Using jOOQ

Java Object Oriented Querying (jOOQ) is a popular product from
Data Geekery which generates Java code from your
database, and lets you build type safe SQL queries through its fluent API. Both the
commercial and open source editions can be used with Spring Boot.

29.5.1 Code Generation

In order to use jOOQ type-safe queries, you need to generate Java classes from your
database schema. You can follow the instructions in the
jOOQ user manual.
If you are using the jooq-codegen-maven plugin (and you also use the
spring-boot-starter-parent “parent POM”) you can safely omit the plugin’s <version>
tag. You can also use Spring Boot defined version variables (e.g. h2.version) to
declare the plugin’s database dependency. Here’s an example:

29.5.2 Using DSLContext

The fluent API offered by jOOQ is initiated via the org.jooq.DSLContext interface.
Spring Boot will auto-configure a DSLContext as a Spring Bean and connect it to your
application DataSource. To use the DSLContext you can just @Autowire it:

29.5.3 jOOQ SQL dialect

Spring Boot determines the SQL dialect to use for your datasource unless the
spring.jooq.sql-dialect property has been configured. If the dialect couldn’t be
detected, DEFAULT is used.

Note

Spring Boot can only auto-configure dialects supported by the open source version of
jOOQ.

29.5.4 Customizing jOOQ

More advanced customizations can be achieved by defining your own @Bean definitions
which will be used when the jOOQ Configuration is created. You can define beans for
the following jOOQ Types:

ConnectionProvider

TransactionProvider

RecordMapperProvider

RecordListenerProvider

ExecuteListenerProvider

VisitListenerProvider

You can also create your own org.jooq.Configuration@Bean if you want to take
complete control of the jOOQ configuration.

30. Working with NoSQL technologies

Spring Data provides additional projects that help you access a variety of NoSQL
technologies including
MongoDB,
Neo4J,
Elasticsearch,
Solr,
Redis,
Gemfire,
Cassandra,
Couchbase and
LDAP.
Spring Boot provides auto-configuration for Redis, MongoDB, Neo4j, Elasticsearch, Solr
Cassandra, Couchbase and LDAP; you can make use of the other projects, but you will need
to configure them yourself. Refer to the appropriate reference documentation at
projects.spring.io/spring-data.

30.1 Redis

Redis is a cache, message broker and richly-featured key-value store.
Spring Boot offers basic auto-configuration for the
Jedis and Lettuce
client library and abstractions on top of it provided by
Spring Data Redis.

There is a spring-boot-starter-data-redis ‘Starter’ for collecting the dependencies in
a convenient way that uses Jedis by default. If you
are building a reactive application, the spring-boot-starter-data-redis-reactive
‘Starter’ will get you going.

30.1.1 Connecting to Redis

You can inject an auto-configured RedisConnectionFactory, StringRedisTemplate or
vanilla RedisTemplate instance as you would any other Spring Bean. By default the
instance will attempt to connect to a Redis server using localhost:6379:

You can also register an arbitrary number of beans implementing
JedisClientConfigurationBuilderCustomizer for more advanced customizations. If you are
using Lettuce, LettuceClientConfigurationBuilderCustomizer is also available.

If you add a @Bean of your own of any of the auto-configured types it will replace the
default (except in the case of RedisTemplate the exclusion is based on the bean name
‘redisTemplate’ not its type). If commons-pool2 is on the classpath you will get a
pooled connection factory by default.

30.2 MongoDB

MongoDB is an open-source NoSQL document database that uses a
JSON-like schema instead of traditional table-based relational data. Spring Boot offers
several conveniences for working with MongoDB, including the
spring-boot-starter-data-mongodb and spring-boot-starter-data-mongodb-reactive
‘Starters’.

30.2.1 Connecting to a MongoDB database

You can inject an auto-configured org.springframework.data.mongodb.MongoDbFactory to
access Mongo databases. By default the instance will attempt to connect to a MongoDB
server using the URL mongodb://localhost/test:

Alternatively, as long as you’re using Mongo 2.x, specify a host/port. For example,
you might declare the following in your application.properties:

spring.data.mongodb.host=mongoserver
spring.data.mongodb.port=27017

Note

spring.data.mongodb.host and spring.data.mongodb.port are not supported if
you’re using the Mongo 3.0 Java driver. In such cases, spring.data.mongodb.uri should be
used to provide all of the configuration.

Tip

If spring.data.mongodb.port is not specified the default of 27017 is used. You
could simply delete this line from the sample above.

Tip

If you aren’t using Spring Data Mongo you can inject com.mongodb.Mongo beans
instead of using MongoDbFactory.

You can also declare your own MongoDbFactory or Mongo bean if you want to take
complete control of establishing the MongoDB connection.

30.2.2 MongoTemplate

Spring Data Mongo provides a
MongoTemplate class that is very
similar in its design to Spring’s JdbcTemplate. As with JdbcTemplate Spring Boot
auto-configures a bean for you to simply inject:

30.2.3 Spring Data MongoDB repositories

Spring Data includes repository support for MongoDB. As with the JPA repositories
discussed earlier, the basic principle is that queries are constructed for you
automatically based on method names.

In fact, both Spring Data JPA and Spring Data MongoDB share the same common
infrastructure; so you could take the JPA example from earlier and, assuming that City
is now a Mongo data class rather than a JPA @Entity, it will work in the same way.

For complete details of Spring Data MongoDB, including its rich object mapping
technologies, refer to their reference
documentation.

30.2.4 Embedded Mongo

Spring Boot offers auto-configuration for
Embedded Mongo. To use
it in your Spring Boot application add a dependency on
de.flapdoodle.embed:de.flapdoodle.embed.mongo.

The port that Mongo will listen on can be configured using the spring.data.mongodb.port
property. To use a randomly allocated free port use a value of zero. The MongoClient
created by MongoAutoConfiguration will be automatically configured to use the randomly
allocated port.

Note

If you do not configure a custom port, the embedded support will use a random port
by default (rather than 27017).

If you have SLF4J on the classpath, output produced by Mongo will be automatically routed
to a logger named org.springframework.boot.autoconfigure.mongo.embedded.EmbeddedMongo.

You can declare your own IMongodConfig and IRuntimeConfig beans to take control of the
Mongo instance’s configuration and logging routing.

30.3 Neo4j

Neo4j is an open-source NoSQL graph database that uses a rich data
model of nodes related by first class relationships which is better suited for connected
big data than traditional rdbms approaches. Spring Boot offers several conveniences for
working with Neo4j, including the spring-boot-starter-data-neo4j ‘Starter’.

30.3.1 Connecting to a Neo4j database

You can inject an auto-configured Neo4jSession, Session or Neo4jOperations instance
as you would any other Spring Bean. By default the instance will attempt to connect to a
Neo4j server using localhost:7474:

30.3.2 Using the embedded mode

If you add org.neo4j:neo4j-ogm-embedded-driver to the dependencies of your application,
Spring Boot will automatically configure an in-process embedded instance of Neo4j that
will not persist any data when your application shuts down. You can explicitly disable
that mode using spring.data.neo4j.embedded.enabled=false. You can also enable
persistence for the embedded mode:

spring.data.neo4j.uri=file://var/tmp/graph.db

Note

The Neo4j OGM embedded driver does not provide the Neo4j kernel. Users are expected to
provide this dependency manually, see
the documentation
for more details.

30.3.3 Neo4jSession

By default, if you are running a web application, the session is bound to the thread for
the entire processing of the request (i.e. the "Open Session in View" pattern). If you
don’t want this behavior add the following to your application.properties:

spring.data.neo4j.open-in-view=false

30.3.4 Spring Data Neo4j repositories

Spring Data includes repository support for Neo4j.

In fact, both Spring Data JPA and Spring Data Neo4j share the same common
infrastructure; so you could take the JPA example from earlier and, assuming that City
is now a Neo4j OGM @NodeEntity rather than a JPA @Entity, it will work in the same
way.

Tip

You can customize entity scanning locations using the @EntityScan annotation.

To enable repository support (and optionally support for @Transactional), add the
following two annotations to your Spring configuration:

30.5 Solr

Apache Solr is a search engine. Spring Boot offers basic
auto-configuration for the Solr 5 client library and abstractions on top of it provided by
Spring Data Solr. There is
a spring-boot-starter-data-solr ‘Starter’ for collecting the dependencies in a
convenient way.

30.5.1 Connecting to Solr

You can inject an auto-configured SolrClient instance as you would any other Spring
bean. By default the instance will attempt to connect to a server using
localhost:8983/solr:

If you add a @Bean of your own of type SolrClient it will replace the default.

30.5.2 Spring Data Solr repositories

Spring Data includes repository support for Apache Solr. As with the JPA repositories
discussed earlier, the basic principle is that queries are constructed for you
automatically based on method names.

In fact, both Spring Data JPA and Spring Data Solr share the same common infrastructure;
so you could take the JPA example from earlier and, assuming that City is now a
@SolrDocument class rather than a JPA @Entity, it will work in the same way.

30.6 Elasticsearch

Elasticsearch is an open source, distributed,
real-time search and analytics engine. Spring Boot offers basic auto-configuration for
the Elasticsearch and abstractions on top of it provided by
Spring Data Elasticsearch.
There is a spring-boot-starter-data-elasticsearch ‘Starter’ for collecting the
dependencies in a convenient way. Spring Boot also supports
Jest.

30.6.1 Connecting to Elasticsearch using Jest

If you have Jest on the classpath, you can inject an auto-configured JestClient
targeting localhost:9200 by default. You can further tune how the client is
configured:

30.6.2 Connecting to Elasticsearch using Spring Data

To connect to Elasticsearch you must provide the address of one or more cluster nodes.
The address can be specified by setting the spring.data.elasticsearch.cluster-nodes
property to a comma-separated ‘host:port’ list. With this configuration in place, an
ElasticsearchTemplate or TransportClient can be injected like any other Spring bean:

If you add your own ElasticsearchTemplate or TransportClient@Bean it will
replace the default.

30.6.3 Spring Data Elasticsearch repositories

Spring Data includes repository support for Elasticsearch. As with the JPA repositories
discussed earlier, the basic principle is that queries are constructed for you
automatically based on method names.

In fact, both Spring Data JPA and Spring Data Elasticsearch share the same common
infrastructure; so you could take the JPA example from earlier and, assuming that
City is now an Elasticsearch @Document class rather than a JPA @Entity, it will
work in the same way.

30.7 Cassandra

Cassandra is an open source, distributed database management
system designed to handle large amounts of data across many commodity servers. Spring Boot
offers auto-configuration for Cassandra and abstractions on top of it provided by
Spring Data Cassandra.
There is a spring-boot-starter-data-cassandra ‘Starter’ for collecting the
dependencies in a convenient way.

30.7.1 Connecting to Cassandra

You can inject an auto-configured CassandraTemplate or a Cassandra Session
instance as you would with any other Spring Bean. The spring.data.cassandra.*
properties can be used to customize the connection. Generally you will provide
keyspace-name and contact-points properties:

30.8 Couchbase

Couchbase is an open-source, distributed multi-model NoSQL
document-oriented database that is optimized for interactive applications. Spring Boot
offers auto-configuration for Couchbase and abstractions on top of it provided by
Spring Data Couchbase.
There is a spring-boot-starter-data-couchbase ‘Starter’ for collecting the
dependencies in a convenient way.

30.8.1 Connecting to Couchbase

You can very easily get a Bucket and Cluster by adding the Couchbase SDK and some
configuration. The spring.couchbase.* properties can be used to customize the
connection. Generally you will provide the bootstrap hosts, bucket name and password:

You need to provide at least the bootstrap host(s), in which case the bucket name
is default and the password is the empty String. Alternatively, you can define your
own org.springframework.data.couchbase.config.CouchbaseConfigurer@Bean to take
control over the whole configuration.

It is also possible to customize some of the CouchbaseEnvironment settings. For instance
the following configuration changes the timeout to use to open a new Bucket and enables
SSL support:

30.8.2 Spring Data Couchbase repositories

Spring Data includes repository support for Couchbase. For complete details of Spring
Data Couchbase, refer to their
reference documentation.

You can inject an auto-configured CouchbaseTemplate instance as you would with any
other Spring Bean as long as a defaultCouchbaseConfigurer is available (that
happens when you enable the couchbase support as explained above).

If you want to fully bypass the auto-configuration for Spring Data Couchbase, provide
your own org.springframework.data.couchbase.config.AbstractCouchbaseDataConfiguration
implementation.

30.9 LDAP

LDAP (Lightweight
Directory Access Protocol) is an open, vendor-neutral, industry standard application
protocol for accessing and maintaining distributed directory information services over an
IP network. Spring Boot offers auto-configuration for any compliant LDAP server as well
as support for the embedded in-memory LDAP server from
UnboundID.

LDAP abstractions are provided by
Spring Data LDAP.
There is a spring-boot-starter-data-ldap ‘Starter’ for collecting the dependencies in
a convenient way.

30.9.1 Connecting to an LDAP server

To connect to an LDAP server make sure you declare a dependency on the
spring-boot-starter-data-ldap ‘Starter’ or spring-ldap-core then declare the
URLs of your server in your application.properties:

30.9.3 Embedded in-memory LDAP server

For testing purposes Spring Boot supports auto-configuration of an in-memory LDAP server
from UnboundID. To configure the server
add a dependency to com.unboundid:unboundid-ldapsdk and declare a base-dn property:

spring.ldap.embedded.base-dn=dc=spring,dc=io

By default the server will start on a random port and they trigger the regular LDAP support
(there is no need to specify a spring.ldap.urls property).

If there is a schema.ldif file on your classpath it will be used to initialize the
server. You can also use the spring.ldap.embedded.ldif property if you want to load
the initialization script from a different resource.

By default, a standard schema will be used to validate LDIF files, you can turn off
validation altogether using the spring.ldap.embedded.validation.enabled property. If
you have custom attributes, you can use spring.ldap.embedded.validation.schema to define
your custom attribute types or object classes.

30.10 InfluxDB

InfluxDB is an open-source time series database optimized for
fast, high-availability storage and retrieval of time series data in fields such as
operations monitoring, application metrics, Internet of Things sensor data, and real-time
analytics.

30.10.1 Connecting to InfluxDB

Spring Boot auto-configures an InfluxDB instance as long as the influxdb-java client
is on the classpath and the url of the database is set:

spring.influx.url=http://172.0.0.1:8086

If the connection to InfluxDB requires a user and password, you can set the
spring.influx.user and spring.influx.password properties accordingly.

31. Caching

The Spring Framework provides support for transparently adding caching to an application.
At its core, the abstraction applies caching to methods, reducing thus the number of
executions based on the information available in the cache. The caching logic is applied
transparently, without any interference to the invoker. Spring Boot auto-configures the
cache infrastructure as long as the caching support is enabled via the @EnableCaching
annotation.

This example demonstrates the use of caching on a potentially costly operation. Before
invoking computePiDecimal, the abstraction will look for an entry in the piDecimals
cache matching the i argument. If an entry is found, the content in the cache is
immediately returned to the caller and the method is not invoked. Otherwise, the method is
invoked and the cache is updated before returning the value.

Note

You can also use the standard JSR-107 (JCache) annotations (e.g. @CacheResult)
transparently. We strongly advise you however to not mix and match them.

If you do not add any specific cache library, Spring Boot will auto-configure a
Simple provider that uses concurrent maps in
memory. When a cache is required (i.e. piDecimals in the example above), this provider
will create it on-the-fly for you. The simple provider is not really recommended for
production usage, but it’s great for getting started and making sure that you understand
the features. When you have made up your mind about the cache provider to use, please make
sure to read its documentation to figure out how to configure the caches that your
application uses. Practically all providers require you to explicitly configure every
cache that you use in the application. Some offer a way to customize the default caches
defined by the spring.cache.cache-names property.

Tip

It is also possible to update or
evict data from the cache transparently.

Note

If you are using the cache infrastructure with beans that are not interface-based,
make sure to enable the proxyTargetClass attribute of @EnableCaching.

31.1 Supported cache providers

The cache abstraction does not provide an actual store and relies on abstraction
materialized by the org.springframework.cache.Cache and
org.springframework.cache.CacheManager interfaces.

If you haven’t defined a bean of type CacheManager or a CacheResolver named
cacheResolver (see CachingConfigurer), Spring Boot tries to detect the following
providers (in this order):

It is also possible to force the cache provider to use via the spring.cache.type
property. Use this property if you need to disable
caching altogether in certain environment (e.g. tests).

Tip

Use the spring-boot-starter-cache ‘Starter’ to quickly add basic caching
dependencies. The starter brings in spring-context-support: if you are adding
dependencies manually, you must include spring-context-support in order to use the
JCache, EhCache 2.x or Guava support.

If the CacheManager is auto-configured by Spring Boot, you can further tune its
configuration before it is fully initialized by exposing a bean implementing the
CacheManagerCustomizer interface. The following sets a flag to say that null
values should be passed down to the underlying map.

In the example above, an auto-configured ConcurrentMapCacheManager is expected. If that
is not the case (either you provided your own config or a different cache provider was
auto-configured), the customizer won’t be invoked at all. You can have as many customizers
as you want and you can also order them as usual using @Order or Ordered.

31.1.1 Generic

Generic caching is used if the context defines at least one
org.springframework.cache.Cache bean. A CacheManager wrapping all beans of that type
is created.

31.1.2 JCache (JSR-107)

JCache is bootstrapped via the presence of a javax.cache.spi.CachingProvider on the
classpath (i.e. a JSR-107 compliant caching library) and the JCacheCacheManager
provided by the spring-boot-starter-cache ‘Starter’. There are various compliant
libraries out there and Spring Boot provides dependency management for Ehcache 3,
Hazelcast and Infinispan. Any other compliant library can be added as well.

It might happen that more than one provider is present, in which case the provider must
be explicitly specified. Even if the JSR-107 standard does not enforce a standardized
way to define the location of the configuration file, Spring Boot does its best to
accommodate with implementation details.

# Only necessary if more than one provider is presentspring.cache.jcache.provider=com.acme.MyCachingProvider
spring.cache.jcache.config=classpath:acme.xml

Note

Since a cache library may offer both a native implementation and JSR-107 support
Spring Boot will prefer the JSR-107 support so that the same features are available if
you switch to a different JSR-107 implementation.

Tip

Spring Boot has a general support for Hazelcast. If
a single HazelcastInstance is available, it is automatically reused for the
CacheManager as well unless the spring.cache.jcache.config property is specified.

There are several ways to customize the underlying javax.cache.cacheManager:

Caches can be created on startup via the spring.cache.cache-names property. If a
custom javax.cache.configuration.Configuration bean is defined, it is used to
customize them.

org.springframework.boot.autoconfigure.cache.JCacheManagerCustomizer beans are
invoked with the reference of the CacheManager for full customization.

Tip

If a standard javax.cache.CacheManager bean is defined, it is wrapped
automatically in a org.springframework.cache.CacheManager implementation that the
abstraction expects. No further customization is applied on it.

31.1.3 EhCache 2.x

EhCache 2.x is used if a file named ehcache.xml can be found at the root of the
classpath. If EhCache 2.x, the EhCacheCacheManager provided by the
spring-boot-starter-cache ‘Starter’ and such file is present it is used to bootstrap
the cache manager. An alternate configuration file can be provided as well using:

31.1.4 Hazelcast

31.1.5 Infinispan

Infinispan has no default configuration file location so it must be specified explicitly
(or the default bootstrap is used).

spring.cache.infinispan.config=infinispan.xml

Caches can be created on startup via the spring.cache.cache-names property. If a custom
ConfigurationBuilder bean is defined, it is used to customize them.

Note

The support of Infinispan in Spring Boot is restricted to the embedded mode and is quite
basic. If you want more options you should use the official Infinispan Spring Boot starter
instead, check
the documentation for more details.

31.1.6 Couchbase

If the Couchbase java client and the couchbase-spring-cache implementation are
available and Couchbase is configured, a
CouchbaseCacheManager will be auto-configured. It is also possible to create additional
caches on startup using the spring.cache.cache-names property. These will operate on
the Bucket that was auto-configured. You can also create additional caches on another
Bucket using the customizer: assume you need two caches on the "main" Bucket (foo
and bar) and one biz cache with a custom time to live of 2sec on the anotherBucket. First, you can create the two first caches simply via configuration:

spring.cache.cache-names=foo,bar

Then define this extra @Configuration to configure the extra Bucket and the biz
cache:

This sample configuration reuses the Cluster that was created via auto-configuration.

31.1.7 Redis

If Redis is available and configured, the RedisCacheManager is auto-configured. It is
also possible to create additional caches on startup using the spring.cache.cache-names
property.

Note

By default, a key prefix is added to prevent that if two separate caches use the same
key, Redis would have overlapping keys and be likely to return invalid values. We strongly
recommend to keep this setting enabled if you create your own RedisCacheManager.

31.1.8 Caffeine

Caffeine is a Java 8 rewrite of Guava’s cache that supersede the Guava support. If
Caffeine is present, a CaffeineCacheManager (provided by the
spring-boot-starter-cache ‘Starter’) is auto-configured. Caches can be created
on startup using the spring.cache.cache-names property and customized by one of the
following (in this order):

A cache spec defined by spring.cache.caffeine.spec

A com.github.benmanes.caffeine.cache.CaffeineSpec bean is defined

A com.github.benmanes.caffeine.cache.Caffeine bean is defined

For instance, the following configuration creates a foo and bar caches with a maximum
size of 500 and a time to live of 10 minutes

Besides, if a com.github.benmanes.caffeine.cache.CacheLoader bean is defined, it is
automatically associated to the CaffeineCacheManager. Since the CacheLoader is
going to be associated to all caches managed by the cache manager, it must be defined
as CacheLoader<Object, Object>. Any other generic type will be ignored by the
auto-configuration.

31.1.9 Simple

If none of the other providers can be found, a simple implementation using a
ConcurrentHashMap as cache store is configured. This is the default if no caching
library is present in your application. Caches are created on-the-fly by default but you
can restrict the list of available caches using the cache-names property. For instance,
if you want only foo and bar caches:

spring.cache.cache-names=foo,bar

If you do this and your application uses a cache not listed then it will fail at runtime
when the cache is needed, but not on startup. This is similar to the way the "real" cache
providers behave if you use an undeclared cache.

31.1.10 None

When @EnableCaching is present in your configuration, a suitable cache configuration
is expected as well. If you need to disable caching altogether in certain environments,
force the cache type to none to use a no-op implementation:

spring.cache.type=none

32. Messaging

The Spring Framework provides extensive support for integrating with messaging systems:
from simplified use of the JMS API using JmsTemplate to a complete infrastructure to
receive messages asynchronously. Spring AMQP provides a similar feature set for the
‘Advanced Message Queuing Protocol’ and Spring Boot also provides auto-configuration
options for RabbitTemplate and RabbitMQ. There is also support for STOMP messaging
natively in Spring WebSocket and Spring Boot has support for that through starters and a
small amount of auto-configuration. Spring Boot also has support for Apache Kafka.

32.1 JMS

The javax.jms.ConnectionFactory interface provides a standard method of creating a
javax.jms.Connection for interacting with a JMS broker. Although Spring needs a
ConnectionFactory to work with JMS, you generally won’t need to use it directly yourself
and you can instead rely on higher level messaging abstractions (see the
relevant section of the Spring Framework reference
documentation for details). Spring Boot also auto-configures the necessary infrastructure
to send and receive messages.

32.1.1 ActiveMQ support

Spring Boot can also configure a ConnectionFactory when it detects that ActiveMQ is
available on the classpath. If the broker is present, an embedded broker is started and
configured automatically (as long as no broker URL is specified through configuration).

Note

If you are using spring-boot-starter-activemq the necessary dependencies to
connect or embed an ActiveMQ instance are provided, as well as the Spring infrastructure
to integrate with JMS.

ActiveMQ configuration is controlled by external configuration properties in
spring.activemq.*. For example, you might declare the following section in
application.properties:

By default, ActiveMQ creates a destination if it does not exist yet, so destinations are
resolved against their provided names.

32.1.2 Artemis support

Spring Boot can auto-configure a ConnectionFactory when it detects that Artemis is
available on the classpath. If the broker is present, an embedded broker is started and
configured automatically (unless the mode property has been explicitly set). The supported
modes are: embedded (to make explicit that an embedded broker is required and should
lead to an error if the broker is not available in the classpath), and native to connect
to a broker using the netty transport protocol. When the latter is configured, Spring
Boot configures a ConnectionFactory connecting to a broker running on the local machine
with the default settings.

Note

If you are using spring-boot-starter-artemis the necessary dependencies to
connect to an existing Artemis instance are provided, as well as the Spring infrastructure
to integrate with JMS. Adding org.apache.activemq:artemis-jms-server to your application
allows you to use the embedded mode.

Artemis configuration is controlled by external configuration properties in
spring.artemis.*. For example, you might declare the following section in
application.properties:

When embedding the broker, you can choose if you want to enable persistence, and the list
of destinations that should be made available. These can be specified as a comma-separated
list to create them with the default options; or you can define bean(s) of type
org.apache.activemq.artemis.jms.server.config.JMSQueueConfiguration or
org.apache.activemq.artemis.jms.server.config.TopicConfiguration, for advanced queue and
topic configurations respectively.

No JNDI lookup is involved at all and destinations are resolved against their names,
either using the ‘name’ attribute in the Artemis configuration or the names provided
through configuration.

32.1.3 Using a JNDI ConnectionFactory

If you are running your application in an Application Server Spring Boot will attempt to
locate a JMS ConnectionFactory using JNDI. By default the locations java:/JmsXA and
java:/XAConnectionFactory will be checked. You can use the
spring.jms.jndi-name property if you need to specify an alternative location:

spring.jms.jndi-name=java:/MyConnectionFactory

32.1.4 Sending a message

Spring’s JmsTemplate is auto-configured and you can autowire it directly into your own
beans:

JmsMessagingTemplate
can be injected in a similar manner. If a DestinationResolver or MessageConverter
beans are defined, they are associated automatically to the auto-configured
JmsTemplate.

32.1.5 Receiving a message

When the JMS infrastructure is present, any bean can be annotated with @JmsListener to
create a listener endpoint. If no JmsListenerContainerFactory has been defined, a
default one is configured automatically. If a DestinationResolver or MessageConverter
beans are defined, they are associated automatically to the default factory.

The default factory is transactional by default. If you are running in an infrastructure
where a JtaTransactionManager is present, it will be associated to the listener container
by default. If not, the sessionTransacted flag will be enabled. In that latter scenario,
you can associate your local data store transaction to the processing of an incoming
message by adding @Transactional on your listener method (or a delegate thereof). This
will make sure that the incoming message is acknowledged once the local transaction has
completed. This also includes sending response messages that have been performed on the
same JMS session.

The following component creates a listener endpoint on the someQueue destination:

If you need to create more JmsListenerContainerFactory instances or if you want to
override the default, Spring Boot provides a DefaultJmsListenerContainerFactoryConfigurer
that you can use to initialize a DefaultJmsListenerContainerFactory with the same
settings as the one that is auto-configured.

For instance, the following exposes another factory that uses a specific
MessageConverter:

32.2 AMQP

The Advanced Message Queuing Protocol (AMQP) is a platform-neutral, wire-level protocol
for message-oriented middleware. The Spring AMQP project applies core Spring concepts to
the development of AMQP-based messaging solutions. Spring Boot offers several
conveniences for working with AMQP via RabbitMQ, including the
spring-boot-starter-amqp ‘Starter’.

32.2.1 RabbitMQ support

RabbitMQ is a lightweight, reliable, scalable and portable message broker based on the
AMQP protocol. Spring uses RabbitMQ to communicate using the AMQP protocol.

RabbitMQ configuration is controlled by external configuration properties in
spring.rabbitmq.*. For example, you might declare the following section in
application.properties:

RabbitMessagingTemplate
can be injected in a similar manner. If a MessageConverter bean is defined, it is
associated automatically to the auto-configured AmqpTemplate.

Any org.springframework.amqp.core.Queue that is defined as a bean will be automatically
used to declare a corresponding queue on the RabbitMQ instance if necessary.

You can enable retries on the AmqpTemplate to retry operations, for example in the event
the broker connection is lost. Retries are disabled by default.

32.2.3 Receiving a message

When the Rabbit infrastructure is present, any bean can be annotated with
@RabbitListener to create a listener endpoint. If no RabbitListenerContainerFactory
has been defined, a default SimpleRabbitListenerContainerFactory is configured
automatically and you can switch to a direct container using the
spring.rabbitmq.listener.type property. If a MessageConverter or MessageRecoverer
beans are defined, they are associated automatically to the default factory.

The following component creates a listener endpoint on the someQueue queue:

If you need to create more RabbitListenerContainerFactory instances or if you want to
override the default, Spring Boot provides a
SimpleRabbitListenerContainerFactoryConfigurer and
DirectRabbitListenerContainerFactoryConfigurer that you can use to initialize a
SimpleRabbitListenerContainerFactory and DirectRabbitListenerContainerFactory with the
same settings as the one used by the auto-configuration.

Tip

It doesn’t matter which container type you’ve chosen, those two beans are exposed by
the auto-configuration.

For instance, the following exposes another factory that uses a specific
MessageConverter:

You can enable retries to handle situations where your listener throws an exception. By
default RejectAndDontRequeueRecoverer is used but you can define a MessageRecoverer
of your own. When retries are exhausted, the message will be rejected and either dropped
or routed to a dead-letter exchange if the broker is configured so. Retries are disabled
by default.

Important

If retries are not enabled and the listener throws an exception, by default the
delivery will be retried indefinitely. You can modify this behavior in two ways; set the
defaultRequeueRejected property to false and zero re-deliveries will be attempted; or,
throw an AmqpRejectAndDontRequeueException to signal the message should be rejected.
This is the mechanism used when retries are enabled and the maximum delivery attempts are
reached.

32.3 Apache Kafka Support

Apache Kafka is supported by providing auto-configuration of the
spring-kafka project.

Kafka configuration is controlled by external configuration properties in
spring.kafka.*. For example, you might declare the following section in
application.properties:

32.3.2 Receiving a Message

When the Apache Kafka infrastructure is present, any bean can be annotated with
@KafkaListener to create a listener endpoint. If no KafkaListenerContainerFactory
has been defined, a default one is configured automatically with keys defined in
spring.kafka.listener.*.

The following component creates a listener endpoint on the someTopic topic:

32.3.3 Additional Kafka Properties

The properties supported by auto configuration are shown in
Appendix A, Common application properties. Note that these properties (hyphenated or camelCase)
map directly to the Apache Kafka dotted properties for the most part, refer to the Apache
Kafka documentation for details.

The first few of these properties apply to both producers and consumers, but can be
specified at the producer or consumer level if you wish to use different values for each.
Apache Kafka designates properties with an importance: HIGH, MEDIUM and LOW. Spring Boot
auto configuration supports all HIGH importance properties, some selected MEDIUM and LOW,
and any that do not have a default value.

Only a subset of the properties supported by Kafka are available via the KafkaProperties
class. If you wish to configure the producer or consumer with additional properties that
are not directly supported, use the following:

spring.kafka.properties.foo.bar=baz

This sets the common foo.bar Kafka property to baz.

These properties will be shared by both the consumer and producer factory beans.
If you wish to customize these components with different properties, such as to use a
different metrics reader for each, you can override the bean definitions, as follows:

33. Calling REST services

If you need to call remote REST services from your application, you can use Spring
Framework’s RestTemplate class. Since RestTemplate instances often need to be
customized before being used, Spring Boot does not provide any single auto-configured
RestTemplate bean. It does, however, auto-configure a RestTemplateBuilder which can be
used to create RestTemplate instances when needed. The auto-configured
RestTemplateBuilder will ensure that sensible HttpMessageConverters are applied
to RestTemplate instances.

RestTemplateBuilder includes a number of useful methods that can be used to quickly
configure a RestTemplate. For example, to add BASIC auth support you can use
builder.basicAuthorization("user", "password").build().

33.1 RestTemplate customization

There are three main approaches to RestTemplate customization, depending on how broadly
you want the customizations to apply.

To make the scope of any customizations as narrow as possible, inject the auto-configured
RestTemplateBuilder and then call its methods as required. Each method call returns a
new RestTemplateBuilder instance so the customizations will only affect this use of
the builder.

To make an application-wide, additive customization a RestTemplateCustomizer bean can be
used. All such beans are automatically registered with the auto-configured
RestTemplateBuilder and will be applied to any templates that are built with it.

Here’s an example of a customizer that configures the use of a proxy for all hosts except
192.168.0.5:

Lastly, the most extreme (and rarely used) option is to create your own
RestTemplateBuilder bean. This will switch off the auto-configuration of a
RestTemplateBuilder and will prevent any RestTemplateCustomizer beans from being used.

34. Validation

The method validation feature supported by Bean Validation 1.1 is automatically enabled
as long as a JSR-303 implementation (e.g. Hibernate validator) is on the classpath. This
allows bean methods to be annotated with javax.validation constraints on their
parameters and/or on their return value. Target classes with such annotated methods need
to be annotated with the @Validated annotation at the type level for their methods to
be searched for inline constraint annotations.

For instance, the following service triggers the validation of the first argument, making
sure its size is between 8 and 10

If spring.mail.host and the relevant libraries (as defined by
spring-boot-starter-mail) are available, a default JavaMailSender is created if none
exists. The sender can be further customized by configuration items from the spring.mail
namespace, see the
MailProperties for more
details.

In particular, certain default timeout values are infinite and you may want to change that
to avoid having a thread blocked by an unresponsive mail server:

36. Distributed Transactions with JTA

Spring Boot supports distributed JTA transactions across multiple XA resources using
either an Atomikos or Bitronix
embedded transaction manager. JTA transactions are also supported when deploying to a
suitable Java EE Application Server.

When a JTA environment is detected, Spring’s JtaTransactionManager will be used to
manage transactions. Auto-configured JMS, DataSource and JPA beans will be upgraded to
support XA transactions. You can use standard Spring idioms such as @Transactional to
participate in a distributed transaction. If you are within a JTA environment and still
want to use local transactions you can set the spring.jta.enabled property to false to
disable the JTA auto-configuration.

36.1 Using an Atomikos transaction manager

Atomikos is a popular open source transaction manager which can be embedded into your
Spring Boot application. You can use the spring-boot-starter-jta-atomikos Starter to
pull in the appropriate Atomikos libraries. Spring Boot will auto-configure Atomikos and
ensure that appropriate depends-on settings are applied to your Spring beans for correct
startup and shutdown ordering.

By default Atomikos transaction logs will be written to a transaction-logs directory in
your application home directory (the directory in which your application jar file
resides). You can customize this directory by setting a spring.jta.log-dir property in
your application.properties file. Properties starting spring.jta.atomikos.properties
can also be used to customize the Atomikos UserTransactionServiceImp. See the
AtomikosProperties Javadoc
for complete details.

Note

To ensure that multiple transaction managers can safely coordinate the same
resource managers, each Atomikos instance must be configured with a unique ID. By default
this ID is the IP address of the machine on which Atomikos is running. To ensure
uniqueness in production, you should configure the spring.jta.transaction-manager-id
property with a different value for each instance of your application.

36.2 Using a Bitronix transaction manager

Bitronix is popular open source JTA transaction manager implementation. You can
use the spring-boot-starter-jta-bitronix starter to add the appropriate Bitronix
dependencies to your project. As with Atomikos, Spring Boot will automatically configure
Bitronix and post-process your beans to ensure that startup and shutdown ordering is
correct.

By default Bitronix transaction log files (part1.btm and part2.btm) will be written to
a transaction-logs directory in your application home directory. You can customize this
directory by using the spring.jta.log-dir property. Properties starting
spring.jta.bitronix.properties are also bound to the bitronix.tm.Configuration bean,
allowing for complete customization. See the
Bitronix documentation
for details.

Note

To ensure that multiple transaction managers can safely coordinate the same
resource managers, each Bitronix instance must be configured with a unique ID. By default
this ID is the IP address of the machine on which Bitronix is running. To ensure
uniqueness in production, you should configure the spring.jta.transaction-manager-id
property with a different value for each instance of your application.

36.3 Using a Narayana transaction manager

Narayana is popular open source JTA transaction manager implementation supported by JBoss.
You can use the spring-boot-starter-jta-narayana starter to add the appropriate
Narayana dependencies to your project. As with Atomikos and Bitronix, Spring Boot will
automatically configure Narayana and post-process your beans to ensure that startup and
shutdown ordering is correct.

By default Narayana transaction logs will be written to a transaction-logs directory in
your application home directory (the directory in which your application jar file
resides). You can customize this directory by setting a spring.jta.log-dir property in
your application.properties file. Properties starting spring.jta.narayana.properties
can also be used to customize the Narayana configuration. See the
NarayanaProperties Javadoc
for complete details.

Note

To ensure that multiple transaction managers can safely coordinate the same
resource managers, each Narayana instance must be configured with a unique ID. By default
this ID is set to 1. To ensure uniqueness in production, you should configure the
spring.jta.transaction-manager-id property with a different value for each instance of
your application.

36.4 Using a Java EE managed transaction manager

If you are packaging your Spring Boot application as a war or ear file and deploying
it to a Java EE application server, you can use your application servers built-in
transaction manager. Spring Boot will attempt to auto-configure a transaction manager by
looking at common JNDI locations (java:comp/UserTransaction,
java:comp/TransactionManager etc). If you are using a transaction service provided by
your application server, you will generally also want to ensure that all resources are
managed by the server and exposed over JNDI. Spring Boot will attempt to auto-configure
JMS by looking for a ConnectionFactory at the JNDI path java:/JmsXA or
java:/XAConnectionFactory and you can use the
spring.datasource.jndi-name property
to configure your DataSource.

36.5 Mixing XA and non-XA JMS connections

When using JTA, the primary JMS ConnectionFactory bean will be XA aware and participate
in distributed transactions. In some situations you might want to process certain JMS
messages using a non-XA ConnectionFactory. For example, your JMS processing logic might
take longer than the XA timeout.

If you want to use a non-XA ConnectionFactory you can inject the
nonXaJmsConnectionFactory bean rather than the @PrimaryjmsConnectionFactory bean.
For consistency the jmsConnectionFactory bean is also provided using the bean alias
xaJmsConnectionFactory.

36.6 Supporting an alternative embedded transaction manager

The XAConnectionFactoryWrapper
and XADataSourceWrapper interfaces
can be used to support alternative embedded transaction managers. The interfaces are
responsible for wrapping XAConnectionFactory and XADataSource beans and exposing them
as regular ConnectionFactory and DataSource beans which will transparently enroll in
the distributed transaction. DataSource and JMS auto-configuration will use JTA variants
as long as you have a JtaTransactionManager bean and appropriate XA wrapper beans
registered within your ApplicationContext.

37. Hazelcast

If hazelcast is on the classpath and a suitable configuration is found, Spring Boot
will auto-configure an HazelcastInstance that you can inject in your application.

You can define a com.hazelcast.config.Config bean and we’ll use that. If your
configuration defines an instance name, we’ll try to locate an existing instance rather
than creating a new one.

You could also specify the hazelcast.xml configuration file to use via configuration:

spring.hazelcast.config=classpath:config/my-hazelcast.xml

Otherwise, Spring Boot tries to find the Hazelcast configuration from the default
locations, that is hazelcast.xml in the working directory or at the root of the
classpath. We also check if the hazelcast.config system property is set. Check the
Hazelcast documentation for
more details.

If hazelcast-client is present on the classpath, Spring Boot will first attempt to
create a client with similar rules as above, that is:

The presence of a com.hazelcast.client.config.ClientConfig bean

A configuration file defined by the spring.hazelcast.config property

The presence of the hazelcast.client.config system property

A hazelcast-client.xml in the working directory or at the root of the classpath

38. Quartz Scheduler

Spring Boot offers several conveniences for working with the Quartz scheduler, including
the spring-boot-starter-quartz ‘Starter’. If Quartz is available, a Scheduler will
be auto-configured (via the SchedulerFactoryBean abstraction).

Beans of the following types will be automatically picked up and associated with the
the Scheduler:

JobDetail: defines a particular Job. JobDetail instance can easily be built with
the JobBuilder API

Calendar

Trigger: defines when a particular job is triggered

By default, an in-memory JobStore will be used. However, it is possible to configure
a JDBC-based store if a DataSource bean is available in your application and if the
spring.quartz.job-store-type property is configured accordingly:

spring.quartz.job-store-type=jdbc

When the jdbc store is used, the schema can be initialized on startup:

spring.quartz.jdbc.initialize-schema=true

Note

The database is detected by default and initialized using the standard scripts
provided with the Quartz library. It is also possible to provide a custom script using the
spring.quartz.jdbc.schema property.

39. Spring Integration

Spring Boot offers several conveniences for working with Spring Integration, including
the spring-boot-starter-integration ‘Starter’. Spring Integration provides
abstractions over messaging and also other transports such as HTTP, TCP etc. If Spring
Integration is available on your classpath it will be initialized through the
@EnableIntegration annotation.

Spring Boot will also configure some features that are triggered by the presence of
additional Spring Integration modules. Message processing statistics will be published
over JMX if 'spring-integration-jmx' is also on the classpath. If
'spring-integration-jdbc' is available, the default database schema can be created
on startup:

42. Testing

Spring Boot provides a number of utilities and annotations to help when testing your
application. Test support is provided by two modules; spring-boot-test contains core
items, and spring-boot-test-autoconfigure supports auto-configuration for tests.

Most developers will just use the spring-boot-starter-test ‘Starter’ which
imports both Spring Boot test modules as well has JUnit, AssertJ, Hamcrest and a number
of other useful libraries.

42.1 Test scope dependencies

If you use the
spring-boot-starter-test ‘Starter’ (in the testscope), you will find
the following provided libraries:

These are common libraries that we generally find useful when writing tests. You are free
to add additional test dependencies of your own if these don’t suit your needs.

42.2 Testing Spring applications

One of the major advantages of dependency injection is that it should make your code
easier to unit test. You can simply instantiate objects using the new operator without
even involving Spring. You can also use mock objects instead of real dependencies.

Often you need to move beyond ‘unit testing’ and start ‘integration testing’ (with
a Spring ApplicationContext actually involved in the process). It’s useful to be able
to perform integration testing without requiring deployment of your application or
needing to connect to other infrastructure.

The Spring Framework includes a dedicated test module for just such integration testing.
You can declare a dependency directly to org.springframework:spring-test or use the
spring-boot-starter-test ‘Starter’ to pull it in transitively.

If you have not used the spring-test module before you should start by reading the
relevant section of the Spring Framework reference
documentation.

42.3 Testing Spring Boot applications

A Spring Boot application is just a Spring ApplicationContext, so nothing very special
has to be done to test it beyond what you would normally do with a vanilla Spring context.
One thing to watch out for though is that the external properties, logging and other
features of Spring Boot are only installed in the context by default if you use
SpringApplication to create it.

Spring Boot provides a @SpringBootTest annotation which can be used as an
alternative to the standard spring-test@ContextConfiguration annotation when you need
Spring Boot features. The annotation works by creating the ApplicationContext used
in your tests via SpringApplication.

You can use the webEnvironment attribute of @SpringBootTest to further refine
how your tests will run:

MOCK — Loads a WebApplicationContext and provides a mock servlet environment.
Embedded servlet containers are not started when using this annotation. If servlet
APIs are not on your classpath this mode will transparently fallback to creating a
regular non-web ApplicationContext. Can be used in conjunction with
@AutoConfigureMockMvc for MockMvc-based testing of your application.

RANDOM_PORT — Loads an ServletWebServerApplicationContext and provides a real
servlet environment. Embedded servlet containers are started and listening on a random
port.

DEFINED_PORT — Loads an ServletWebServerApplicationContext and provides a real
servlet environment. Embedded servlet containers are started and listening on a defined
port (i.e from your application.properties or on the default port 8080).

NONE — Loads an ApplicationContext using SpringApplication but does not provide
any servlet environment (mock or otherwise).

Note

If your test is @Transactional, it will rollback the transaction at the end of
each test method by default. If you’re using this arrangement in combination with either
RANDOM_PORT or DEFINED_PORT, any transaction initiated on the server won’t rollback as
the test is running in a different thread than the server processing.

Note

In addition to @SpringBootTest a number of other annotations are also
provided for testing more specific slices of an application. See below for details.

Tip

Don’t forget to also add @RunWith(SpringRunner.class) to your test, otherwise
the annotations will be ignored.

42.3.1 Detecting test configuration

If you’re familiar with the Spring Test Framework, you may be used to using
@ContextConfiguration(classes=…​) in order to specify which Spring @Configuration
to load. Alternatively, you might have often used nested @Configuration classes within
your test.

The search algorithm works up from the package that contains the test until it finds a
@SpringBootApplication or @SpringBootConfiguration annotated class. As long as you’ve
structured your code in a sensible way your main
configuration is usually found.

If you want to customize the primary configuration, you can use a nested
@TestConfiguration class. Unlike a nested @Configuration class which would be used
instead of a your application’s primary configuration, a nested @TestConfiguration class
will be used in addition to your application’s primary configuration.

Note

Spring’s test framework will cache application contexts between tests. Therefore, as
long as your tests share the same configuration (no matter how it’s discovered), the
potentially time consuming process of loading the context will only happen once.

42.3.2 Excluding test configuration

If your application uses component scanning, for example if you use
@SpringBootApplication or @ComponentScan, you may find top-level configuration classes
created only for specific tests accidentally get picked up everywhere.

As we have seen above,
@TestConfiguration can be used on an inner class of a test to customize the primary
configuration. When placed on a top-level class, @TestConfiguration indicates that
classes in src/test/java should not be picked up by scanning. You can then import that
class explicitly where it is required:

If you directly use @ComponentScan (i.e. not via @SpringBootApplication) you
will need to register the TypeExcludeFilter with it. See
the Javadoc for details.

42.3.3 Working with random ports

If you need to start a full running server for tests, we recommend that you use random
ports. If you use @SpringBootTest(webEnvironment=WebEnvironment.RANDOM_PORT)
an available port will be picked at random each time your test runs.

The @LocalServerPort annotation can be used to
inject the actual port used into your test.
For convenience, tests that need to make REST calls to the started server can additionally
@Autowire a TestRestTemplate which will resolve relative links to the running server.

42.3.4 Mocking and spying beans

It’s sometimes necessary to mock certain components within your application context when
running tests. For example, you may have a facade over some remote service that’s
unavailable during development. Mocking can also be useful when you want to simulate
failures that might be hard to trigger in a real environment.

Spring Boot includes a @MockBean annotation that can be used to define a Mockito mock
for a bean inside your ApplicationContext. You can use the annotation to add new beans,
or replace a single existing bean definition. The annotation can be used directly on test
classes, on fields within your test, or on @Configuration classes and fields. When used
on a field, the instance of the created mock will also be injected. Mock beans are
automatically reset after each test method.

Here’s a typical example where we replace an existing RemoteService bean with a mock
implementation:

Additionally you can also use @SpyBean to wrap any existing bean with a Mockito spy.
See the Javadoc for full details.

42.3.5 Auto-configured tests

Spring Boot’s auto-configuration system works well for applications, but can sometimes be
a little too much for tests. It’s often helpful to load only the parts of the
configuration that are required to test a ‘slice’ of your application. For example, you
might want to test that Spring MVC controllers are mapping URLs correctly, and you don’t
want to involve database calls in those tests; or you might be wanting to test JPA
entities, and you’re not interested in web layer when those tests run.

The spring-boot-test-autoconfigure module includes a number of annotations that can be
used to automatically configure such ‘slices’. Each of them works in a similar way,
providing a @…​Test annotation that loads the ApplicationContext and one or
more @AutoConfigure…​ annotations that can be used to customize auto-configuration
settings.

Note

Each slice loads a very restricted set of auto-configuration classes. If you need to
exclude one of them, most @…​Test annotations provide an excludeAutoConfiguration
attribute. Alternatively, you can use @ImportAutoConfiguration#exclude.

Tip

It’s also possible to use the @AutoConfigure…​ annotations with the standard
@SpringBootTest annotation. You can use this combination if you’re not interested
in ‘slicing’ your application but you want some of the auto-configured test beans.

42.3.6 Auto-configured JSON tests

To test that Object JSON serialization and deserialization is working as expected you can
use the @JsonTest annotation. @JsonTest will auto-configure Jackson ObjectMapper,
any @JsonComponent beans and any Jackson Modules. It also configures Gson
if you happen to be using that instead of, or as well as, Jackson. If you need to
configure elements of the auto-configuration you can use the @AutoConfigureJsonTesters
annotation.

Spring Boot includes AssertJ based helpers that work with the JSONassert and JsonPath
libraries to check that JSON is as expected. The JacksonTester, GsonTester and
BasicJsonTester classes can be used for Jackson, Gson and Strings respectively. Any
helper fields on the test class can be @Autowired when using @JsonTest.

42.3.7 Auto-configured Spring MVC tests

To test Spring MVC controllers are working as expected you can use the @WebMvcTest
annotation. @WebMvcTest will auto-configure the Spring MVC infrastructure and limit
scanned beans to @Controller, @ControllerAdvice, @JsonComponent, Filter,
WebMvcConfigurer and HandlerMethodArgumentResolver. Regular @Component beans
will not be scanned when using this annotation.

Often @WebMvcTest will be limited to a single controller and used in combination with
@MockBean to provide mock implementations for required collaborators.

@WebMvcTest also auto-configures MockMvc. Mock MVC offers a powerful way to quickly
test MVC controllers without needing to start a full HTTP server.

Tip

You can also auto-configure MockMvc in a non-@WebMvcTest (e.g. SpringBootTest)
by annotating it with @AutoConfigureMockMvc.

By default Spring Boot will put WebDriver beans in a special “scope” to ensure
that the driver is quit after each test, and that a new instance is injected. If you don’t
want this behavior you can add @Scope("singleton") to your WebDriver@Bean
definition.

42.3.8 Auto-configured Data JPA tests

@DataJpaTest can be used if you want to test JPA applications. By default it will
configure an in-memory embedded database, scan for @Entity classes and configure Spring
Data JPA repositories. Regular @Component beans will not be loaded into the
ApplicationContext.

Data JPA tests are transactional and rollback at the end of each test by default,
see the relevant section in the
Spring Reference Documentation for more details. If that’s not what you want, you can
disable transaction management for a test or for the whole class as follows:

Data JPA tests may also inject a
TestEntityManager
bean which provides an alternative to the standard JPA EntityManager specifically
designed for tests. If you want to use TestEntityManager outside of @DataJpaTests you
can also use the @AutoConfigureTestEntityManager annotation. A JdbcTemplate is also
available if you need that.

In-memory embedded databases generally work well for tests since they are fast and don’t
require any developer installation. If, however, you prefer to run tests against a real
database you can use the @AutoConfigureTestDatabase annotation:

42.3.9 Auto-configured JDBC tests

@JdbcTest is similar to @DataJpaTest but for pure jdbc-related tests. By default it
will also configure an in-memory embedded database and a JdbcTemplate. Regular
@Component beans will not be loaded into the ApplicationContext.

JDBC tests are transactional and rollback at the end of each test by default,
see the relevant section in the
Spring Reference Documentation for more details. If that’s not what you want, you can
disable transaction management for a test or for the whole class as follows:

42.3.10 Auto-configured jOOQ tests

@JooqTest can be used in a similar fashion as @JdbcTest but for jOOQ related tests. As
jOOQ relies heavily on a Java-based schema that corresponds with the database schema, the
existing DataSource will be used. If you want to replace it by an in-memory database you
can use @AutoconfigureTestDatabase to override those settings.

@JooqTest will configure a DSLContext. Regular @Component beans will not be loaded
into the ApplicationContext:

JOOQ tests are transactional and rollback at the end of each test by default. If that’s
not what you want, you can disable transaction management for a test or for the whole test
class as shown
in the example above.

42.3.11 Auto-configured Data MongoDB tests

@DataMongoTest can be used if you want to test MongoDB applications. By default, it will
configure an in-memory embedded MongoDB (if available), configure a MongoTemplate, scan
for @Document classes and configure Spring Data MongoDB repositories. Regular
@Component beans will not be loaded into the ApplicationContext:

In-memory embedded MongoDB generally works well for tests since it is fast and doesn’t
require any developer installation. If, however, you prefer to run tests against a real
MongoDB server you should exclude the embedded MongoDB auto-configuration:

42.3.12 Auto-configured Data Neo4j tests

@DataNeo4jTest can be used if you want to test Neo4j applications. By default, it will
use an in-memory embedded Neo4j (if the embedded driver is available), scan for
@NodeEntity classes and configure Spring Data Neo4j repositories. Regular @Component
beans will not be loaded into the ApplicationContext:

Data Neo4j tests are transactional and rollback at the end of each test by default,
see the relevant section in the
Spring Reference Documentation for more details. If that’s not what you want, you can
disable transaction management for a test or for the whole class as follows:

42.3.13 Auto-configured Data Redis tests

@DataRedisTest can be used if you want to test Redis applications. By default, it will
scan for @RedisHash classes and configure Spring Data Redis repositories. Regular
@Component beans will not be loaded into the ApplicationContext:

42.3.14 Auto-configured Data LDAP tests

@DataLdapTest can be used if you want to test LDAP applications. By default, it will
configure an in-memory embedded LDAP (if available), a LdapTemplate, scan for @Entry
classes and configure Spring Data LDAP repositories. Regular @Component beans will not
be loaded into the ApplicationContext:

In-memory embedded LDAP generally works well for tests since it is fast and doesn’t
require any developer installation. If, however, you prefer to run tests against a real
LDAP server you should exclude the embedded LDAP auto-configuration:

42.3.15 Auto-configured REST clients

The @RestClientTest annotation can be used if you want to test REST clients. By default
it will auto-configure Jackson and GSON support, configure a RestTemplateBuilder and
add support for MockRestServiceServer. The specific beans that you want to test should
be specified using value or components attribute of @RestClientTest:

42.3.16 Auto-configured Spring REST Docs tests

The @AutoConfigureRestDocs annotation can be used if you want to use Spring REST Docs
in your tests. It will automatically configure MockMvc to use Spring REST Docs and
remove the need for Spring REST Docs' JUnit rule.

@AutoConfigureRestDocs can be used to override the default output directory
(target/generated-snippets if you are using Maven or build/generated-snippets if you
are using Gradle). It can also be used to configure the host, scheme, and port that will
appear in any documented URIs. If you require more control over Spring REST Docs'
configuration a RestDocsMockMvcConfigurationCustomizer bean can be used:

If you want to make use of Spring REST Docs' support for a parameterized output directory,
you can create a RestDocumentationResultHandler bean. The auto-configuration will
call alwaysDo with this result handler, thereby causing each MockMvc call to
automatically generate the default snippets:

42.3.17 Using Spock to test Spring Boot applications

If you wish to use Spock to test a Spring Boot application you should add a dependency
on Spock’s spock-spring module to your application’s build. spock-spring integrates
Spring’s test framework into Spock. It is recommended that you use Spock 1.1 or later to
benefit from a number of recent improvements to Spock’s Spring Framework and Spring Boot
integration. Please refer to the
documentation for Spock’s Spring module for further details.

42.4 Test utilities

A few test utility classes are packaged as part of spring-boot that are generally
useful when testing your application.

42.4.1 ConfigFileApplicationContextInitializer

ConfigFileApplicationContextInitializer is an ApplicationContextInitializer that
can apply to your tests to load Spring Boot application.properties files. You can use
this when you don’t need the full features provided by @SpringBootTest.

Using ConfigFileApplicationContextInitializer alone won’t provide support for
@Value("${…​}") injection. Its only job is to ensure that application.properties files
are loaded into Spring’s Environment. For @Value support you need to either
additionally configure a PropertySourcesPlaceholderConfigurer or use @SpringBootTest
where one will be auto-configured for you.

42.4.2 EnvironmentTestUtils

EnvironmentTestUtils allows you to quickly add properties to a
ConfigurableEnvironment or ConfigurableApplicationContext. Simply call it with
key=value strings:

EnvironmentTestUtils.addEnvironment(env, "org=Spring", "name=Boot");

42.4.3 OutputCapture

OutputCapture is a JUnit Rule that you can use to capture System.out and
System.err output. Simply declare the capture as a @Rule then use toString()
for assertions:

42.4.4 TestRestTemplate

TestRestTemplate is a convenience alternative to Spring’s RestTemplate that is useful
in integration tests. You can get a vanilla template or one that sends Basic HTTP
authentication (with a username and password). In either case the template will behave
in a test-friendly way by not throwing exceptions on server-side errors. It is
recommended, but not mandatory, to use Apache HTTP Client (version 4.3.2 or better), and
if you have that on your classpath the TestRestTemplate will respond by configuring
the client appropriately. If you do use Apache’s HTTP client some additional test-friendly
features will be enabled:

Redirects will not be followed (so you can assert the response location)

Cookies will be ignored (so the template is stateless)

TestRestTemplate can be instantiated directly in your integration tests:

Alternatively, if you are using the @SpringBootTest annotation with
WebEnvironment.RANDOM_PORT or WebEnvironment.DEFINED_PORT, you can just inject a
fully configured TestRestTemplate and start using it. If necessary, additional
customizations can be applied via the RestTemplateBuilder bean. Any URLs that do not
specify a host and port will automatically connect to the embedded server:

43. WebSockets

Spring Boot provides WebSockets auto-configuration for embedded Tomcat (8 and 7), Jetty 9
and Undertow. If you’re deploying a war file to a standalone container, Spring Boot
assumes that the container will be responsible for the configuration of its WebSocket
support.

Spring Framework provides rich WebSocket support that can
be easily accessed via the spring-boot-starter-websocket module.

44. Web Services

Spring Boot provides Web Services auto-configuration so that all is required is defining
your Endpoints.

45. Creating your own auto-configuration

If you work in a company that develops shared libraries, or if you work on an open-source
or commercial library, you might want to develop your own auto-configuration.
Auto-configuration classes can be bundled in external jars and still be picked-up by
Spring Boot.

Auto-configuration can be associated to a "starter" that provides the auto-configuration
code as well as the typical libraries that you would use with it. We will first cover what
you need to know to build your own auto-configuration and we will move on to the
typical steps required to create a custom starter.

Tip

A demo project
is available to showcase how you can create a starter step by step.

45.1 Understanding auto-configured beans

Under the hood, auto-configuration is implemented with standard @Configuration classes.
Additional @Conditional annotations are used to constrain when the auto-configuration
should apply. Usually auto-configuration classes use @ConditionalOnClass and
@ConditionalOnMissingBean annotations. This ensures that auto-configuration only applies
when relevant classes are found and when you have not declared your own @Configuration.

You can use the
@AutoConfigureAfter or
@AutoConfigureBefore
annotations if your configuration needs to be applied in a specific order. For example, if
you provide web-specific configuration, your class may need to be applied after
WebMvcAutoConfiguration.

If you want to order certain auto-configurations that shouldn’t have any direct
knowledge of each other, you can also use @AutoconfigureOrder. That annotation has the
same semantic as the regular @Order annotation but provides a dedicated order for
auto-configuration classes.

Note

Auto-configurations have to be loaded that way only. Make sure that they are defined in
a specific package space and that they are never the target of component scan in
particular.

45.3 Condition annotations

You almost always want to include one or more @Conditional annotations on your
auto-configuration class. The @ConditionalOnMissingBean is one common example that is
used to allow developers to ‘override’ auto-configuration if they are not happy with
your defaults.

Spring Boot includes a number of @Conditional annotations that you can reuse in your own
code by annotating @Configuration classes or individual @Bean methods.

45.3.1 Class conditions

The @ConditionalOnClass and @ConditionalOnMissingClass annotations allows
configuration to be included based on the presence or absence of specific classes. Due to
the fact that annotation metadata is parsed using ASM you can
actually use the value attribute to refer to the real class, even though that class
might not actually appear on the running application classpath. You can also use the
name attribute if you prefer to specify the class name using a String value.

Tip

If you are using @ConditionalOnClass or @ConditionalOnMissingClass as a part of a
meta-annotation to compose your own composed annotations you must use name as referring
to the class in such a case is not handled.

45.3.2 Bean conditions

The @ConditionalOnBean and @ConditionalOnMissingBean annotations allow a bean
to be included based on the presence or absence of specific beans. You can use the value
attribute to specify beans by type, or name to specify beans by name. The search
attribute allows you to limit the ApplicationContext hierarchy that should be considered
when searching for beans.

When placed on a @Bean method, the target type defaults to the return type of the
method, for instance:

In the example above, the myService bean is going to be created if no bean of type
MyService is already contained in the ApplicationContext.

Tip

You need to be very careful about the order that bean definitions are added as these
conditions are evaluated based on what has been processed so far. For this reason,
we recommend only using @ConditionalOnBean and @ConditionalOnMissingBean annotations
on auto-configuration classes (since these are guaranteed to load after any user-defined
beans definitions have been added).

Note

@ConditionalOnBean and @ConditionalOnMissingBean do not prevent @Configuration
classes from being created. Using these conditions at the class level is equivalent to
marking each contained @Bean method with the annotation.

45.3.3 Property conditions

The @ConditionalOnProperty annotation allows configuration to be included based on a
Spring Environment property. Use the prefix and name attributes to specify the
property that should be checked. By default any property that exists and is not equal to
false will be matched. You can also create more advanced checks using the havingValue
and matchIfMissing attributes.

45.3.4 Resource conditions

The @ConditionalOnResource annotation allows configuration to be included only when a
specific resource is present. Resources can be specified using the usual Spring
conventions, for example, file:/home/user/test.dat.

45.3.5 Web application conditions

The @ConditionalOnWebApplication and @ConditionalOnNotWebApplication annotations
allow configuration to be included depending on whether the application is a 'web
application'. A web application is any application that is using a Spring
WebApplicationContext, defines a session scope or has a StandardServletEnvironment.

45.3.6 SpEL expression conditions

The @ConditionalOnExpression annotation allows configuration to be included based on the
result of a SpEL expression.

45.4 Creating your own starter

A full Spring Boot starter for a library may contain the following components:

The autoconfigure module that contains the auto-configuration code.

The starter module that provides a dependency to the autoconfigure module as well as
the library and any additional dependencies that are typically useful. In a nutshell,
adding the starter should be enough to start using that library.

Tip

You may combine the auto-configuration code and the dependency management in a single
module if you don’t need to separate those two concerns.

45.4.1 Naming

Please make sure to provide a proper namespace for your starter. Do not start your module
names with spring-boot, even if you are using a different Maven groupId. We may offer an
official support for the thing you’re auto-configuring in the future.

Here is a rule of thumb. Let’s assume that you are creating a starter for "acme", name the
auto-configure module acme-spring-boot-autoconfigure and the starter
acme-spring-boot-starter. If you only have one module combining the two, use
acme-spring-boot-starter.

Besides, if your starter provides configuration keys, use a proper namespace for them. In
particular, do not include your keys in the namespaces that Spring Boot uses (e.g.
server, management, spring, etc). These are "ours" and we may improve/modify them
in the future in such a way it could break your things.

Make sure to
trigger
meta-data generation so that IDE assistance is available for your keys as well. You
may want to review the generated meta-data (META-INF/spring-configuration-metadata.json)
to make sure your keys are properly documented.

45.4.2 Autoconfigure module

The autoconfigure module contains everything that is necessary to get started with the
library. It may also contain configuration keys definition (@ConfigurationProperties)
and any callback interface that can be used to further customize how the components are
initialized.

Tip

You should mark the dependencies to the library as optional so that you can include
the autoconfigure module in your projects more easily. If you do it that way, the library
won’t be provided and Spring Boot will back off by default.

45.4.3 Starter module

The starter is an empty jar, really. Its only purpose is to provide the necessary
dependencies to work with the library; see it as an opinionated view of what is required
to get started.

Do not make assumptions about the project in which your starter is added. If the library
you are auto-configuring typically requires other starters, mention them as well. Providing
a proper set of default dependencies may be hard if the number of optional dependencies
is high as you should avoid bringing unnecessary dependencies for a typical usage of the
library.

Part V. Spring Boot Actuator: Production-ready features

Spring Boot includes a number of additional features to help you monitor and manage your
application when it’s pushed to production. You can choose to manage and monitor your
application using HTTP endpoints or with JMX. Auditing, health and metrics gathering can
be automatically applied to your application.

48. Endpoints

Actuator endpoints allow you to monitor and interact with your application. Spring Boot
includes a number of built-in endpoints and you can also add your own. For example the
health endpoint provides basic application health information.

The way that endpoints are exposed will depend on the type of technology that you choose.
Most applications choose HTTP monitoring, where the ID of the endpoint along with a prefix of
/application is mapped to a URL. For example, by default, the health endpoint will be mapped
to /application/health.

The following technology agnostic endpoints are available:

ID

Description

Sensitive Default

actuator

Provides a hypermedia-based “discovery page” for the other endpoints. Requires Spring
HATEOAS to be on the classpath.

true

auditevents

Exposes audit events information for the current application.

true

autoconfig

Displays an auto-configuration report showing all auto-configuration candidates and the
reason why they ‘were’ or ‘were not’ applied.

true

beans

Displays a complete list of all the Spring beans in your application.

true

configprops

Displays a collated list of all @ConfigurationProperties.

true

dump

Performs a thread dump.

true

env

Exposes properties from Spring’s ConfigurableEnvironment.

true

flyway

Shows any Flyway database migrations that have been applied.

true

health

Shows application health information (when the application is secure, a simple ‘status’
when accessed over an unauthenticated connection or full message details when
authenticated).

false

info

Displays arbitrary application info.

false

loggers

Shows and modifies the configuration of loggers in the application.

true

liquibase

Shows any Liquibase database migrations that have been applied.

true

metrics

Shows ‘metrics’ information for the current application.

true

mappings

Displays a collated list of all @RequestMapping paths.

true

shutdown

Allows the application to be gracefully shutdown (not enabled by default).

true

trace

Displays trace information (by default the last 100 HTTP requests).

true

If you are using Spring MVC, the following additional endpoints can also be used:

ID

Description

Sensitive Default

docs

Displays documentation, including example requests and responses, for the Actuator’s
endpoints. Requires spring-boot-actuator-docs to be on the classpath.

false

heapdump

Returns a GZip compressed hprof heap dump file.

true

jolokia

Exposes JMX beans over HTTP (when Jolokia is on the classpath).

true

logfile

Returns the contents of the logfile (if logging.file or logging.path properties have
been set). Supports the use of the HTTP Range header to retrieve part of the log file’s
content.

true

Note

Depending on how an endpoint is exposed, the sensitive property may be used as
a security hint. For example, sensitive endpoints will require a username/password when
they are accessed over HTTP (or simply disabled if web security is not enabled).

48.1 Customizing endpoints

Endpoints can be customized using Spring properties. You can change if an endpoint is
enabled, if it is considered sensitive and even its id.

For example, here is an application.properties that changes the sensitivity and id
of the beans endpoint and also enables shutdown.

The prefix ‟endpoints + . + name” is used to uniquely identify the endpoint
that is being configured.

By default, all endpoints except for shutdown are enabled. If you prefer to
specifically “opt-in” endpoint enablement you can use the endpoints.enabled property.
For example, the following will disable all endpoints except for info:

endpoints.enabled=false
endpoints.info.enabled=true

Likewise, you can also choose to globally set the “sensitive” flag of all endpoints. By
default, the sensitive flag depends on the type of endpoint (see the table above).
For example, to mark all endpoints as sensitive except info:

endpoints.sensitive=true
endpoints.info.sensitive=false

48.2 Hypermedia for actuator MVC endpoints

If endpoints.hypermedia.enabled is set to true and
Spring HATEOAS is on the classpath (e.g.
through the spring-boot-starter-hateoas or if you are using
Spring Data REST) then the HTTP endpoints
from the Actuator are enhanced with hypermedia links, and a “discovery page” is added
with links to all the endpoints. The “discovery page” is available on /application by
default. It is implemented as an endpoint, allowing properties to be used to configure
its path (endpoints.actuator.path) and whether or not it is enabled
(endpoints.actuator.enabled).

When a custom management context path is configured, the “discovery page” will
automatically move from /application to the root of the management context. For example,
if the management context path is /management then the discovery page will be available
from /management.

If the HAL Browser is on the classpath
via its webjar (org.webjars:hal-browser), or via the spring-data-rest-hal-browser then
an HTML “discovery page”, in the form of the HAL Browser, is also provided.

48.4 Adding custom endpoints

If you add a @Bean of type Endpoint then it will automatically be exposed over JMX and
HTTP (if there is an server available). An HTTP endpoints can be customized further by
creating a bean of type MvcEndpoint. Your MvcEndpoint is not a @Controller but it
can use @RequestMapping (and @Managed*) to expose resources.

Tip

If you are doing this as a library feature consider adding a configuration class
annotated with @ManagementContextConfiguration to /META-INF/spring.factories under the
key org.springframework.boot.actuate.autoconfigure.ManagementContextConfiguration. If
you do that then the endpoint will move to a child context with all the other MVC
endpoints if your users ask for a separate management port or address. A configuration
declared this way can be a WebConfigurerAdapter if it wants to add static resources (for
instance) to the management endpoints.

48.5 Health information

Health information can be used to check the status of your running application. It is
often used by monitoring software to alert someone if a production system goes down.
The default information exposed by the health endpoint depends on how it is accessed.
For an unauthenticated connection in a secure application a simple ‘status’ message is
returned, and for an authenticated connection additional details are also displayed (see
Section 49.7, “HTTP health endpoint format and access restrictions” for HTTP details).

Health information is collected from all
HealthIndicator beans defined
in your ApplicationContext. Spring Boot includes a number of auto-configured
HealthIndicators and you can also write your own.

48.6 Security with HealthIndicators

Information returned by HealthIndicators is often somewhat sensitive in nature. For
example, you probably don’t want to publish details of your database server to the
world. For this reason, by default, only the health status is exposed over an
unauthenticated HTTP connection. If you are happy for complete health information to always
be exposed you can set endpoints.health.sensitive to false.

Health responses are also cached to prevent “denial of service” attacks. Use the
endpoints.health.time-to-live property if you want to change the default cache period
of 1000 milliseconds.

48.6.1 Auto-configured HealthIndicators

The following HealthIndicators are auto-configured by Spring Boot when appropriate:

It is possible to disable them all using the management.health.defaults.enabled
property.

48.6.2 Writing custom HealthIndicators

To provide custom health information you can register Spring beans that implement the
HealthIndicator interface.
You need to provide an implementation of the health() method and return a Health
response. The Health response should include a status and can optionally include
additional details to be displayed.

The identifier for a given HealthIndicator is the name of the bean without the
HealthIndicator suffix if it exists. In the example above, the health information will
be available in an entry named my.

In addition to Spring Boot’s predefined Status
types, it is also possible for Health to return a custom Status that represents a
new system state. In such cases a custom implementation of the
HealthAggregator
interface also needs to be provided, or the default implementation has to be configured
using the management.health.status.order configuration property.

For example, assuming a new Status with code FATAL is being used in one of your
HealthIndicator implementations. To configure the severity order add the following
to your application properties:

The HTTP status code in the response reflects the overall health status (e.g. UP
maps to 200, OUT_OF_SERVICE or DOWN to 503). You might also want to register custom
status mappings with the HealthMvcEndpoint if you access the health endpoint over HTTP.
For example, the following maps FATAL to HttpStatus.SERVICE_UNAVAILABLE:

endpoints.health.mapping.FATAL=503

48.7 Application information

Application information exposes various information collected from all
InfoContributor beans defined
in your ApplicationContext. Spring Boot includes a number of auto-configured
InfoContributors and you can also write your own.

48.7.1 Auto-configured InfoContributors

The following InfoContributors are auto-configured by Spring Boot when appropriate:

Expose build information if a META-INF/build-info.properties file is available.

Tip

It is possible to disable them all using the management.info.defaults.enabled
property.

48.7.2 Custom application info information

You can customize the data exposed by the info endpoint by setting info.* Spring
properties. All Environment properties under the info key will be automatically
exposed. For example, you could add the following to your application.properties:

48.7.3 Git commit information

Another useful feature of the info endpoint is its ability to publish information
about the state of your git source code repository when the project was built. If a
GitProperties bean is available, the git.branch, git.commit.id and
git.commit.time properties will be exposed.

Tip

A GitProperties bean is auto-configured if a git.properties file is available
at the root of the classpath. See
Generate git information for more details.

If you want to display the full git information (i.e. the full content of
git.properties), use the management.info.git.mode property:

management.info.git.mode=full

48.7.4 Build information

The info endpoint can also publish information about your build if a BuildProperties
bean is available. This happens if a META-INF/build-info.properties file is available
in the classpath.

If you hit the info endpoint you should see a response that contains the following
additional entry:

{"example": {"key" : "value"}}

49. Monitoring and management over HTTP

If you are developing a Spring MVC application, Spring Boot Actuator will auto-configure
all enabled endpoints to be exposed over HTTP. The default convention is to use the
id of the endpoint with a prefix of /application as the URL path. For example, health
is exposed as /application/health.

49.1 Accessing sensitive endpoints

By default all sensitive HTTP endpoints are secured such that only users that have an
ACTUATOR role may access them. Security is enforced using the standard
HttpServletRequest.isUserInRole method.

Tip

Use the management.security.roles property if you want something different to
ACTUATOR.

If you are deploying applications behind a firewall, you may prefer that all your actuator
endpoints can be accessed without requiring authentication. You can do this by changing
the management.security.enabled property:

application.properties.

management.security.enabled=false

Note

By default, actuator endpoints are exposed on the same port that serves regular
HTTP traffic. Take care not to accidentally expose sensitive information if you change
the management.security.enabled property.

If you’re deploying applications publicly, you may want to add ‘Spring Security’ to
handle user authentication. When ‘Spring Security’ is added, by default ‘basic’
authentication will be used with the username user and a generated password (which is
printed on the console when the application starts).

You can use Spring properties to change the username and password and to change the
security role(s) required to access the endpoints. For example, you might set the following
in your application.properties:

If your application has custom security configuration and you want all your actuator endpoints
to be accessible without authentication, you need to explicitly configure that in your
security configuration. Along with that, you need to change the management.security.enabled
property to false.

If your custom security configuration secures your actuator endpoints, you also need to ensure that
the authenticated user has the roles specified under management.security.roles.

Tip

If you don’t have a use case for exposing basic health information to unauthenticated users,
and you have secured the actuator endpoints with custom security, you can set management.security.enabled
to false. This will inform Spring Boot to skip the additional role check.

49.2 Customizing the management endpoint paths

Sometimes it is useful to customize the prefix for the management endpoints.
For example, your application might already use /application for another purpose.
You can use the management.context-path property to change the prefix for your management endpoint:

management.context-path=/manage

The application.properties example above will change the endpoint from /application/{id} to
/manage/{id} (e.g. /manage/info).

You can also change the “path” of an endpoint (using endpoints.{name}.path) which then
changes the default resource path for the MVC endpoint. There is no validation on
those values (so you can use anything that is legal in a URL path). For example, to change
the location of the /health endpoint to /ping/me you can set
endpoints.health.path=/ping/me.

Note

Even if an endpoint path is configured separately, it is still relative to the
management.context-path.

Tip

If you provide a custom MvcEndpoint remember to include a settable path property,
and default it to /{id} if you want your code to behave like the standard MVC endpoints.
(Take a look at the HealthMvcEndpoint to see how you might do that.) If your custom
endpoint is an Endpoint (not an MvcEndpoint) then Spring Boot will take care of the
path for you.

49.3 Customizing the management server port

Exposing management endpoints using the default HTTP port is a sensible choice for cloud
based deployments. If, however, your application runs inside your own data center you
may prefer to expose endpoints using a different HTTP port.

The management.port property can be used to change the HTTP port.

management.port=8081

Since your management port is often protected by a firewall, and not exposed to the public
you might not need security on the management endpoints, even if your main application is
secure. In that case you will have Spring Security on the classpath, and you can disable
management security like this:

management.security.enabled=false

(If you don’t have Spring Security on the classpath then there is no need to explicitly
disable the management security in this way, and it might even break the application.)

49.4 Configuring management-specific SSL

When configured to use a custom port, the management server can also be configured with
its own SSL using the various management.ssl.* properties. For example, this allows a
management server to be available via HTTP while the main application uses HTTPS:

49.5 Customizing the management server address

You can customize the address that the management endpoints are available on by
setting the management.address property. This can be useful if you want to
listen only on an internal or ops-facing network, or to only listen for connections from
localhost.

Note

You can only listen on a different address if the port is different to the
main server port.

Here is an example application.properties that will not allow remote management
connections:

management.port=8081
management.address=127.0.0.1

49.6 Disabling HTTP endpoints

If you don’t want to expose endpoints over HTTP you can set the management port to -1:

management.port=-1

49.7 HTTP health endpoint format and access restrictions

The information exposed by the health endpoint varies depending on whether or not it’s
accessed anonymously, and whether or not the enclosing application is secure.
By default, when accessed anonymously in a secure application, any details about the
server’s health are hidden and the endpoint will simply indicate whether or not the server
is up or down. Furthermore the response is cached for a configurable period to prevent the
endpoint being used in a denial of service attack. The endpoints.health.time-to-live
property is used to configure the caching period in milliseconds. It defaults to 1000,
i.e. one second.

The above-described restrictions can be enhanced, thereby allowing only authenticated
users full access to the health endpoint in a secure application. To do so, set
endpoints.health.sensitive to true. Here’s a summary of behavior (with default
sensitive flag value “false” indicated in bold):

50.1 Customizing MBean names

The name of the MBean is usually generated from the id of the endpoint. For example
the health endpoint is exposed as org.springframework.boot/Endpoint/healthEndpoint.

If your application contains more than one Spring ApplicationContext you may find that
names clash. To solve this problem you can set the endpoints.jmx.unique-names property
to true so that MBean names are always unique.

You can also customize the JMX domain under which endpoints are exposed. Here is an
example application.properties:

endpoints.jmx.domain=myapp
endpoints.jmx.unique-names=true

50.2 Disabling JMX endpoints

If you don’t want to expose endpoints over JMX you can set the endpoints.jmx.enabled
property to false:

endpoints.jmx.enabled=false

50.3 Using Jolokia for JMX over HTTP

Jolokia is a JMX-HTTP bridge giving an alternative method of accessing JMX beans. To
use Jolokia, simply include a dependency to org.jolokia:jolokia-core. For example,
using Maven you would add the following:

Jolokia can then be accessed using /jolokia on your management HTTP server.

50.3.1 Customizing Jolokia

Jolokia has a number of settings that you would traditionally configure using servlet
parameters. With Spring Boot you can use your application.properties, simply prefix the
parameter with jolokia.config.:

jolokia.config.debug=true

50.3.2 Disabling Jolokia

If you are using Jolokia but you don’t want Spring Boot to configure it, simply set the
endpoints.jolokia.enabled property to false:

endpoints.jolokia.enabled=false

51. Loggers

Spring Boot Actuator includes the ability to view and configure the log levels of your
application at runtime. You can view either the entire list or an individual logger’s
configuration which is made up of both the explicitly configured logging level as well as
the effective logging level given to it by the logging framework. These levels can be:

TRACE

DEBUG

INFO

WARN

ERROR

FATAL

OFF

null

with null indicating that there is no explicit configuration.

51.1 Configure a Logger

In order to configure a given logger, you POST a partial entity to the resource’s URI:

{"configuredLevel": "DEBUG"}

Tip

You can also pass a nullconfiguredLevel to "reset" the specific level of the
logger (and use the default configuration instead).

52. Metrics

Spring Boot Actuator includes a metrics service with ‘gauge’ and ‘counter’ support.
A ‘gauge’ records a single value; and a ‘counter’ records a delta (an increment or
decrement). Spring Boot Actuator also provides a
PublicMetrics interface that
you can implement to expose metrics that you cannot record via one of those two
mechanisms. Look at SystemPublicMetrics
for an example.

Metrics for all HTTP requests are automatically recorded, so if you hit the metrics
endpoint you should see a response similar to this:

Here we can see basic memory, heap, class loading, processor and thread pool
information along with some HTTP metrics. In this instance the root (‘/’) and /metrics
URLs have returned HTTP 200 responses 20 and 3 times respectively. It also appears
that the root URL returned HTTP 401 (unauthorized) 4 times. The double asterisks (star-star)
comes from a request matched by Spring MVC as /** (normally a static resource).

The gauge shows the last response time for a request. So the last request to root took
2ms to respond and the last to /metrics took 3ms.

Note

In this example we are actually accessing the endpoint over HTTP using the
/metrics URL, this explains why metrics appears in the response.

52.1 System metrics

The following system metrics are exposed by Spring Boot:

The total system memory in KB (mem)

The amount of free memory in KB (mem.free)

The number of processors (processors)

The system uptime in milliseconds (uptime)

The application context uptime in milliseconds (instance.uptime)

The average system load (systemload.average)

Heap information in KB (heap, heap.committed, heap.init, heap.used)

Thread information (threads, thread.peak, thread.daemon)

Class load information (classes, classes.loaded, classes.unloaded)

Garbage collection information (gc.xxx.count, gc.xxx.time)

52.2 DataSource metrics

The following metrics are exposed for each supported DataSource defined in your
application:

The number of active connections (datasource.xxx.active)

The current usage of the connection pool (datasource.xxx.usage).

All data source metrics share the datasource. prefix. The prefix is further qualified
for each data source:

If the data source is the primary data source (that is either the only available data
source or the one flagged @Primary amongst the existing ones), the prefix is
datasource.primary.

If the data source bean name ends with DataSource, the prefix is the name of the bean
without DataSource (i.e. datasource.batch for batchDataSource).

In all other cases, the name of the bean is used.

It is possible to override part or all of those defaults by registering a bean with a
customized version of DataSourcePublicMetrics. By default, Spring Boot provides metadata
for all supported data sources; you can add additional DataSourcePoolMetadataProvider
beans if your favorite data source isn’t supported out of the box. See
DataSourcePoolMetadataProvidersConfiguration for examples.

52.3 Cache metrics

The following metrics are exposed for each supported cache defined in your application:

The current size of the cache (cache.xxx.size)

Hit ratio (cache.xxx.hit.ratio)

Miss ratio (cache.xxx.miss.ratio)

Note

Cache providers do not expose the hit/miss ratio in a consistent way. While some
expose an aggregated value (i.e. the hit ratio since the last time the stats were
cleared), others expose a temporal value (i.e. the hit ratio of the last second).
Check your caching provider documentation for more details.

If two different cache managers happen to define the same cache, the name of the cache
is prefixed by the name of the CacheManager bean.

It is possible to override part or all of those defaults by registering a bean with a
customized version of CachePublicMetrics. By default, Spring Boot provides cache
statistics for EhCache, Hazelcast, Infinispan, JCache and Caffeine. You can add additional
CacheStatisticsProvider beans if your favorite caching library isn’t supported out of
the box. See CacheStatisticsAutoConfiguration for examples.

52.4 Tomcat session metrics

If you are using Tomcat as your embedded servlet container, session metrics will
automatically be exposed. The httpsessions.active and httpsessions.max keys provide
the number of active and maximum sessions.

52.5 Recording your own metrics

To record your own metrics inject a
CounterService and/or
GaugeService into
your bean. The CounterService exposes increment, decrement and reset methods; the
GaugeService provides a submit method.

Here is a simple example that counts the number of times that a method is invoked:

You can use any string as a metric name but you should follow guidelines of your chosen
store/graphing technology. Some good guidelines for Graphite are available on
Matt Aimonetti’s Blog.

52.6 Adding your own public metrics

To add additional metrics that are computed every time the metrics endpoint is invoked,
simply register additional PublicMetrics implementation bean(s). By default, all such
beans are gathered by the endpoint. You can easily change that by defining your own
MetricsEndpoint.

52.7 Metric writers, exporters and aggregation

Spring Boot provides a couple of implementations of a marker interface called Exporter
which can be used to copy metric readings from the in-memory buffers to a place where they
can be analyzed and displayed. Indeed, if you provide a @Bean that implements the
MetricWriter interface (or GaugeWriter for simple use cases) and mark it
@ExportMetricWriter, then it will automatically be hooked up to an Exporter and fed
metric updates every 5 seconds (configured via spring.metrics.export.delay-millis).
In addition, any MetricReader that you define and mark as @ExportMetricReader will
have its values exported by the default exporter.

Note

This feature is enabling scheduling in your application (@EnableScheduling) which
can be a problem if you run an integration test as your own scheduled tasks will start.
You can disable this behaviour by setting spring.metrics.export.enabled to false.

The default exporter is a MetricCopyExporter which tries to optimize itself by not
copying values that haven’t changed since it was last called (the optimization can be
switched off using a flag spring.metrics.export.send-latest). Note also that the
Dropwizard MetricRegistry has no support for timestamps, so the optimization is not
available if you are using Dropwizard metrics (all metrics will be copied on every tick).

The default values for the export trigger (delay-millis, includes, excludes
and send-latest) can be set as spring.metrics.export.*. Individual
values for specific MetricWriters can be set as
spring.metrics.export.triggers.<name>.* where <name> is a bean name (or pattern for
matching bean names).

Warning

The automatic export of metrics is disabled if you switch off the default
MetricRepository (e.g. by using Dropwizard metrics). You can get back the same
functionality be declaring a bean of your own of type MetricReader and declaring it to
be @ExportMetricReader.

52.7.1 Example: Export to Redis

If you provide a @Bean of type RedisMetricRepository and mark it @ExportMetricWriter
the metrics are exported to a Redis cache for aggregation. The RedisMetricRepository has
two important parameters to configure it for this purpose: prefix and key (passed into
its constructor). It is best to use a prefix that is unique to the application instance
(e.g. using a random value and maybe the logical name of the application to make it
possible to correlate with other instances of the same application). The “key” is used
to keep a global index of all metric names, so it should be unique “globally”, whatever
that means for your system (e.g. two instances of the same system could share a Redis cache
if they have distinct keys).

The prefix is constructed with the application name and id at the end, so it can easily be used
to identify a group of processes with the same logical name later.

Note

It’s important to set both the key and the prefix. The key is used for all
repository operations, and can be shared by multiple repositories. If multiple
repositories share a key (like in the case where you need to aggregate across them), then
you normally have a read-only “master” repository that has a short, but identifiable,
prefix (like “metrics.mysystem”), and many write-only repositories with prefixes that
start with the master prefix (like metrics.mysystem.* in the example above). It is
efficient to read all the keys from a “master” repository like that, but inefficient to
read a subset with a longer prefix (e.g. using one of the writing repositories).

Tip

The example above uses MetricExportProperties to inject and extract the key and
prefix. This is provided to you as a convenience by Spring Boot, configured with sensible
defaults. There is nothing to stop you using your own values as long as they follow the
recommendations.

52.7.2 Example: Export to Open TSDB

If you provide a @Bean of type OpenTsdbGaugeWriter and mark it
@ExportMetricWriter metrics are exported to Open TSDB for
aggregation. The OpenTsdbGaugeWriter has a url property that you need to set
to the Open TSDB “/put” endpoint, e.g. localhost:4242/api/put). It also has a
namingStrategy that you can customize or configure to make the metrics match the data
structure you need on the server. By default it just passes through the metric name as an
Open TSDB metric name, and adds the tags “domain” (with value
“org.springframework.metrics”) and “process” (with the value equal to the object hash
of the naming strategy). Thus, after running the application and generating some metrics
you can inspect the metrics in the TSD UI (localhost:4242 by default).

52.7.3 Example: Export to Statsd

To export metrics to Statsd, make sure first that you have added
com.timgroup:java-statsd-client as a dependency of your project (Spring Boot
provides a dependency management for it). Then add a spring.metrics.export.statsd.host
value to your application.properties file. Connections will be opened to port 8125
unless a spring.metrics.export.statsd.port override is provided. You can use
spring.metrics.export.statsd.prefix if you want a custom prefix.

Alternatively, you can provide a @Bean of type StatsdMetricWriter and mark it
@ExportMetricWriter:

52.7.4 Example: Export to JMX

If you provide a @Bean of type JmxMetricWriter marked @ExportMetricWriter the metrics are exported as MBeans to
the local server (the MBeanExporter is provided by Spring Boot JMX auto-configuration as
long as it is switched on). Metrics can then be inspected, graphed, alerted etc. using any
tool that understands JMX (e.g. JConsole or JVisualVM).

Each metric is exported as an individual MBean. The format for the ObjectNames is given
by an ObjectNamingStrategy which can be injected into the JmxMetricWriter (the default
breaks up the metric name and tags the first two period-separated sections in a way that
should make the metrics group nicely in JVisualVM or JConsole).

52.8 Aggregating metrics from multiple sources

There is an AggregateMetricReader that you can use to consolidate metrics from different
physical sources. Sources for the same logical metric just need to publish them with a
period-separated prefix, and the reader will aggregate (by truncating the metric names,
and dropping the prefix). Counters are summed and everything else (i.e. gauges) take their
most recent value.

This is very useful if multiple application instances are feeding to a central (e.g.
Redis) repository and you want to display the results. Particularly recommended in
conjunction with a MetricReaderPublicMetrics for hooking up to the results to the
“/metrics” endpoint.

The example above uses MetricExportProperties to inject and extract the key and
prefix. This is provided to you as a convenience by Spring Boot, and the defaults will be
sensible. They are set up in MetricExportAutoConfiguration.

Note

The MetricReaders above are not @Beans and are not marked as
@ExportMetricReader because they are just collecting and analyzing data from other
repositories, and don’t want to export their values.

52.9 Dropwizard Metrics

A default MetricRegistry Spring bean will be created when you declare a dependency to
the io.dropwizard.metrics:metrics-core library; you can also register you own @Bean
instance if you need customizations. Users of the
Dropwizard ‘Metrics’ library will find that
Spring Boot metrics are automatically published to com.codahale.metrics.MetricRegistry.
Metrics from the MetricRegistry are also automatically exposed via the /metrics
endpoint

When Dropwizard metrics are in use, the default CounterService and GaugeService are
replaced with a DropwizardMetricServices, which is a wrapper around the MetricRegistry
(so you can @Autowired one of those services and use it as normal). You can also create
“special” Dropwizard metrics by prefixing your metric names with the appropriate type
(i.e. timer.*, histogram.* for gauges, and meter.* for counters).

52.10 Message channel integration

If a MessageChannel bean called metricsChannel exists, then a MetricWriter will be
created that writes metrics to that channel. Each message sent to the channel will contain
a Delta or
Metric payload and have a metricName
header. The writer is automatically hooked up to an exporter (as for all writers), so all
metric values will appear on the channel, and additional analysis or actions can be taken
by subscribers (it’s up to you to provide the channel and any subscribers you need).

53. Auditing

Spring Boot Actuator has a flexible audit framework that will publish events once Spring
Security is in play (‘authentication success’, ‘failure’ and ‘access denied’
exceptions by default). This can be very useful for reporting, and also to implement a
lock-out policy based on authentication failures. To customize published security events
you can provide your own implementations of AbstractAuthenticationAuditListener and
AbstractAuthorizationAuditListener.

You can also choose to use the audit services for your own business events. To do that
you can either inject the existing AuditEventRepository into your own components and
use that directly, or you can simply publish AuditApplicationEvent via the Spring
ApplicationEventPublisher (using ApplicationEventPublisherAware).

54. Tracing

Tracing is automatically enabled for all HTTP requests. You can view the trace endpoint
and obtain basic information about the last 100 requests:

54.1 Custom tracing

If you need to trace additional events you can inject a
TraceRepository into your
Spring beans. The add method accepts a single Map structure that will be converted to
JSON and logged.

By default an InMemoryTraceRepository will be used that stores the last 100 events. You
can define your own instance of the InMemoryTraceRepository bean if you need to expand
the capacity. You can also create your own alternative TraceRepository implementation
if needed.

55. Process monitoring

In Spring Boot Actuator you can find a couple of classes to create files that are useful
for process monitoring:

ApplicationPidFileWriter creates a file containing the application PID (by default in
the application directory with the file name application.pid).

EmbeddedServerPortFileWriter creates a file (or files) containing the ports of the
embedded server (by default in the application directory with the file name
application.port).

These writers are not activated by default, but you can enable them in one of the ways
described below.

55.1 Extend configuration

In META-INF/spring.factories file you can activate the listener(s) that
writes a PID file. Example:

55.2 Programmatically

You can also activate a listener by invoking the SpringApplication.addListeners(…​)
method and passing the appropriate Writer object. This method also allows you to
customize the file name and path via the Writer constructor.

56. Cloud Foundry support

Spring Boot’s actuator module includes additional support that is activated when you
deploy to a compatible Cloud Foundry instance. The /cloudfoundryapplication path
provides an alternative secured route to all NamedMvcEndpoint beans.

The extended support allows Cloud Foundry management UIs (such as the web
application that you can use to view deployed applications) to be augmented with Spring
Boot actuator information. For example, an application status page may include full health
information instead of the typical “running” or “stopped” status.

Note

The /cloudfoundryapplication path is not directly accessible to regular users.
In order to use the endpoint a valid UAA token must be passed with the request.

56.1 Disabling extended Cloud Foundry actuator support

If you want to fully disable the /cloudfoundryapplication endpoints you can add the
following to your application.properties file:

application.properties.

management.cloudfoundry.enabled=false

56.2 Cloud Foundry self signed certificates

By default, the security verification for /cloudfoundryapplication endpoints makes SSL
calls to various Cloud Foundry services. If your Cloud Foundry UAA or Cloud Controller
services use self-signed certificates you will need to set the following property:

application.properties.

management.cloudfoundry.skip-ssl-validation=true

56.3 Custom security configuration

If you define custom security configuration, and you want extended Cloud Foundry actuator
support, you’ll should ensure that /cloudfoundryapplication/** paths are open. Without
a direct open route, your Cloud Foundry application manager will not be able to obtain
endpoint data.

For Spring Security, you’ll typically include something like
mvcMatchers("/cloudfoundryapplication/**").permitAll() in your configuration:

Part VI. Deploying Spring Boot applications

Spring Boot’s flexible packaging options provide a great deal of choice when it comes to
deploying your application. You can easily deploy Spring Boot applications to a variety
of cloud platforms, to a container images (such as Docker) or to virtual/real machines.

This section covers some of the more common deployment scenarios.

58. Deploying to the cloud

Spring Boot’s executable jars are ready-made for most popular cloud PaaS
(platform-as-a-service) providers. These providers tend to require that you
“bring your own container”; they manage application processes (not Java applications
specifically), so they need some intermediary layer that adapts your application to the
cloud’s notion of a running process.

Two popular cloud providers, Heroku and Cloud Foundry, employ a “buildpack” approach.
The buildpack wraps your deployed code in whatever is needed to start your
application: it might be a JDK and a call to java, it might be an embedded web server,
or it might be a full-fledged application server. A buildpack is pluggable, but ideally
you should be able to get by with as few customizations to it as possible.
This reduces the footprint of functionality that is not under your control. It minimizes
divergence between development and production environments.

Ideally, your application, like a Spring Boot executable jar, has everything that it needs
to run packaged within it.

58.1 Cloud Foundry

Cloud Foundry provides default buildpacks that come into play if no other buildpack is
specified. The Cloud Foundry Java buildpack
has excellent support for Spring applications, including Spring Boot. You can deploy
stand-alone executable jar applications, as well as traditional .war packaged
applications.

Once Cloud Foundry acknowledges that your application has been deployed, you should be
able to hit the application at the URI given, in this case
http://acloudyspringtime.cfapps.io/.

58.1.1 Binding to services

By default, metadata about the running application as well as service connection
information is exposed to the application as environment variables (for example:
$VCAP_SERVICES). This architecture decision is due to Cloud Foundry’s polyglot
(any language and platform can be supported as a buildpack) nature; process-scoped
environment variables are language agnostic.

Environment variables don’t always make for the easiest API so Spring Boot automatically
extracts them and flattens the data into properties that can be accessed through
Spring’s Environment abstraction:

All Cloud Foundry properties are prefixed with vcap. You can use vcap properties to
access application information (such as the public URL of the application) and service
information (such as database credentials). See CloudFoundryVcapEnvironmentPostProcessor
Javadoc for complete details.

Tip

The Spring Cloud Connectors project
is a better fit for tasks such as configuring a DataSource. Spring Boot includes
auto-configuration support and a spring-boot-starter-cloud-connectors starter.

58.2 Heroku

Heroku is another popular PaaS platform. To customize Heroku builds, you provide a
Procfile, which provides the incantation required to deploy an application. Heroku
assigns a port for the Java application to use and then ensures that routing to the
external URI works.

You must configure your application to listen on the correct port. Here’s the Procfile
for our starter REST application:

web: java -Dserver.port=$PORT -jar target/demo-0.0.1-SNAPSHOT.jar

Spring Boot makes -D arguments available as properties accessible from a Spring
Environment instance. The server.port configuration property is fed to the embedded
Tomcat, Jetty or Undertow instance which then uses it when it starts up. The $PORT
environment variable is assigned to us by the Heroku PaaS.

This should be everything you need. The most common workflow for Heroku deployments is to
git push the code to production.

58.3 OpenShift

OpenShift is the RedHat public (and enterprise) PaaS solution.
Like Heroku, it works by running scripts triggered by git commits, so you can script
the launching of a Spring Boot application in pretty much any way you like as long as the
Java runtime is available (which is a standard feature you can ask for at OpenShift).
To do this you can use the
DIY Cartridge and hooks in your
repository under .openshift/action_hooks:

The basic model is to:

Ensure Java and your build tool are installed remotely, e.g. using a pre_build hook
(Java and Maven are installed by default, Gradle is not)

Each has different features and pricing model, here we will describe only the simplest
option : AWS Elastic Beanstalk.

58.4.1 AWS Elastic Beanstalk

As described in the official Elastic
Beanstalk Java guide, there are two main options to deploy a Java application; You can
either use the “Tomcat Platform” or the “Java SE platform”.

Using the Tomcat platform

This option applies to Spring Boot projects producing a war file. There is no any special
configuration required, just follow the official guide.

Using the Java SE platform

This option applies to Spring Boot projects producing a jar file and running an embedded
web container. Elastic Beanstalk environments run an nginx instance on port 80 to proxy
the actual application, running on port 5000. To configure it, add the following to your
application.properties:

server.port=5000

Best practices

Uploading binaries instead of sources

By default Elastic Beanstalk uploads sources and compile them in AWS. To upload the
binaries instead, add the following to your .elasticbeanstalk/config.yml file:

deploy:
artifact: target/demo-0.0.1-SNAPSHOT.jar

Reduce costs by setting the environment type

By default an Elastic Beanstalk environment is load balanced. The load balancer has a cost
perspective, to avoid it, set the environment type to “Single instance” as described
in the Amazon documentation.
Single instance environments can be created using the CLI as well using the following
command:

eb create -s

58.4.2 Summary

This is one of the easiest way to get to AWS, but there are more things
to cover, e.g.: how to integrate Elastic Beanstalk into any CI / CD tool, using the
Elastic Beanstalk maven plugin instead of the CLI, etc. There is a
blog
covering these topics more in detail.

58.5 Boxfuse and Amazon Web Services

Boxfuse works by turning your Spring Boot executable jar or war
into a minimal VM image that can be deployed unchanged either on VirtualBox or on AWS.
Boxfuse comes with deep integration for Spring Boot and will use the information from your
Spring Boot configuration file to automatically configure ports and health check URLs.
Boxfuse leverages this information both for the images it produces as well as for all the
resources it provisions (instances, security groups, elastic load balancers, etc).

Once you have created a Boxfuse account, connected it to your
AWS account, and installed the latest version of the Boxfuse Client, you can deploy your
Spring Boot application to AWS as follows (ensure the application has been built by
Maven or Gradle first using, for example, mvn clean package):

By default Boxfuse will activate a Spring profile named boxfuse on startup and if
your executable jar or war contains an
boxfuse.com/docs/payloads/springboot.html#configuration
[application-boxfuse.properties]
file, Boxfuse will base its configuration based on the properties it contains.

At this point boxfuse will create an image for your application, upload it,
and then configure and start the necessary resources on AWS:

58.6 Google App Engine

Google App Engine is tied to the Servlet 2.5 API, so you can’t deploy a Spring Application
there without some modifications. See the Servlet 2.5 section
of this guide.

59. Installing Spring Boot applications

In additional to running Spring Boot applications using java -jar it is also possible
to make fully executable applications for Unix systems. A fully executable jar can be
executed like any other executable binary or it can be registered
with init.d or systemd. This makes it very easy to install and manage Spring Boot
applications in common production environments.

Warning

Fully executable jars work by embedding an extra script at the front of the
file. Currently, some tools do not accept this format so you may not always be able to
use this technique. For example, jar -xf may silently fail to extract a jar or war that
has been made fully-executable. It is recommended that you only make your jar or war
fully executable if you intend to execute it directly, rather than running it with
java -jar or deploying it to a servlet container.

To create a ‘fully executable’ jar with Maven use the following plugin configuration:

You can then run your application by typing ./my-application.jar (where
my-application is the name of your artifact). The directory containing the
jar will be used as your application’s working directory.

59.1 Supported operating systems

The default script supports most Linux distributions and is tested on CentOS and
Ubuntu. Other platforms, such as OS X and FreeBSD, will require the use of a custom
embeddedLaunchScript.

59.2 Unix/Linux services

Spring Boot application can be easily started as Unix/Linux services using either init.d
or systemd.

59.2.1 Installation as an init.d service (System V)

If you’ve configured Spring Boot’s Maven or Gradle plugin to generate a
fully executable jar, and you’re not using a custom
embeddedLaunchScript, then your application can be used as an init.d service. Simply
symlink the jar to init.d to support the standard start, stop, restart and
status commands.

The script supports the following features:

Starts the services as the user that owns the jar file

Tracks application’s PID using /var/run/<appname>/<appname>.pid

Writes console logs to /var/log/<appname>.log

Assuming that you have a Spring Boot application installed in /var/myapp, to install a
Spring Boot application as an init.d service simply create a symlink:

$ sudo ln -s /var/myapp/myapp.jar /etc/init.d/myapp

Once installed, you can start and stop the service in the usual way. For example, on a
Debian based system:

$ service myapp start

Tip

If your application fails to start, check the log file written to
/var/log/<appname>.log for errors.

You can also flag the application to start automatically using your standard operating
system tools. For example, on Debian:

$ update-rc.d myapp defaults <priority>

Securing an init.d service

Note

The following is a set of guidelines on how to secure a Spring Boot application
that’s being run as an init.d service. It is not intended to be an exhaustive list of
everything that should be done to harden an application and the environment in which it
runs.

When executed as root, as is the case when root is being used to start an init.d service,
the default executable script will run the application as the user which owns the jar
file. You should never run a Spring Boot application as root so your application’s jar
file should never be owned by root. Instead, create a specific user to run your
application and use chown to make it the owner of the jar file. For example:

$ chown bootapp:bootapp your-app.jar

In this case, the default executable script will run the application as the bootapp
user.

Tip

To reduce the chances of the application’s user account being compromised, you should
consider preventing it from using a login shell. Set the account’s shell to
/usr/sbin/nologin, for example.

You should also take steps to prevent the modification of your application’s jar file.
Firstly, configure its permissions so that it cannot be written and can only be read or
executed by its owner:

$ chmod 500 your-app.jar

Secondly, you should also take steps to limit the damage if your application or the
account that’s running it is compromised. If an attacker does gain access, they could make
the jar file writable and change its contents. One way to protect against this is to make
it immutable using chattr:

$ sudo chattr +i your-app.jar

This will prevent any user, including root, from modifying the jar.

If root is used to control the application’s service and you
use a .conf file to customize its
startup, the .conf file will be read and evaluated by the root user. It should be
secured accordingly. Use chmod so that the file can only be read by the owner and use
chown to make root the owner:

$ chmod 400 your-app.conf
$ sudo chown root:root your-app.conf

59.2.2 Installation as a systemd service

Systemd is the successor of the System V init system, and is now being used by many modern
Linux distributions. Although you can continue to use init.d scripts with systemd, it
is also possible to launch Spring Boot applications using systemd ‘service’ scripts.

Assuming that you have a Spring Boot application installed in /var/myapp, to install a
Spring Boot application as a systemd service create a script named myapp.service using
the following example and place it in /etc/systemd/system directory:

Remember to change the Description, User and ExecStart fields for your
application.

Tip

Note that ExecStart field does not declare the script action command, which means
that run command is used by default.

Note that unlike when running as an init.d service, user that runs the application, PID
file and console log file are managed by systemd itself and therefore must be configured
using appropriate fields in ‘service’ script. Consult the
service unit
configuration man page for more details.

To flag the application to start automatically on system boot use the following command:

$ systemctl enable myapp.service

Refer to man systemctl for more details.

59.2.3 Customizing the startup script

The default embedded startup script written by the Maven or Gradle plugin can be
customized in a number of ways. For most people, using the default script along with
a few customizations is usually enough. If you find you can’t customize something that
you need to, you can always use the embeddedLaunchScript option to write your own
file entirely.

Customizing script when it’s written

It often makes sense to customize elements of the start script as it’s written into the
jar file. For example, init.d scripts can provide a “description” and, since you know
this up front (and it won’t change), you may as well provide it when the jar is generated.

To customize written elements, use the embeddedLaunchScriptProperties option of the
Spring Boot Maven or Gradle plugins.

The following property substitutions are supported with the default script:

Name

Description

mode

The script mode. Defaults to auto.

initInfoProvides

The Provides section of “INIT INFO”. Defaults to spring-boot-application for Gradle
and to ${project.artifactId} for Maven.

The Short-Description section of “INIT INFO”. Defaults to Spring Boot Application
for Gradle and to ${project.name} for Maven.

initInfoDescription

The Description section of “INIT INFO”. Defaults to Spring Boot Application for
Gradle and to ${project.description} (falling back to ${project.name}) for Maven.

initInfoChkconfig

The chkconfig section of “INIT INFO”. Defaults to 2345 99 01.

confFolder

The default value for CONF_FOLDER. Defaults to the folder containing the jar.

logFolder

The default value for LOG_FOLDER. Only valid for an init.d service.

logFilename

The default value for LOG_FILENAME. Only valid for an init.d service.

pidFolder

The default value for PID_FOLDER. Only valid for an init.d service.

pidFilename

The default value for the name of the pid file in PID_FOLDER. Only valid for an
init.d service.

useStartStopDaemon

If the start-stop-daemon command, when it’s available, should be used to control the
process. Defaults to true.

stopWaitTime

The default value for STOP_WAIT_TIME. Only valid for an init.d service.
Defaults to 60 seconds.

Customizing script when it runs

For items of the script that need to be customized after the jar has been written you
can use environment variables or a
config file.

The following environment properties are supported with the default script:

Variable

Description

MODE

The “mode” of operation. The default depends on the way the jar was built, but will
usually be auto(meaning it tries to guess if it is an init script by checking if it
is a symlink in a directory called init.d). You can explicitly set it to service so
that the stop|start|status|restart commands work, or to run if you just want to
run the script in the foreground.

USE_START_STOP_DAEMON

If the start-stop-daemon command, when it’s available, should be used to control the
process. Defaults to true.

PID_FOLDER

The root name of the pid folder (/var/run by default).

LOG_FOLDER

The name of the folder to put log files in (/var/log by default).

CONF_FOLDER

The name of the folder to read .conf files from (same folder as jar-file by default).

LOG_FILENAME

The name of the log file in the LOG_FOLDER (<appname>.log by default).

APP_NAME

The name of the app. If the jar is run from a symlink the script guesses the app name,
but if it is not a symlink, or you want to explicitly set the app name this can be
useful.

RUN_ARGS

The arguments to pass to the program (the Spring Boot app).

JAVA_HOME

The location of the java executable is discovered by using the PATH by default, but
you can set it explicitly if there is an executable file at $JAVA_HOME/bin/java.

JAVA_OPTS

Options that are passed to the JVM when it is launched.

JARFILE

The explicit location of the jar file, in case the script is being used to launch a jar
that it is not actually embedded in.

DEBUG

if not empty will set the -x flag on the shell process, making it easy to see the logic
in the script.

STOP_WAIT_TIME

The time in seconds to wait when stopping the application before forcing a shutdown
(60 by default).

Note

The PID_FOLDER, LOG_FOLDER and LOG_FILENAME variables are only valid for an
init.d service. With systemd the equivalent customizations are made using ‘service’
script. Check the
service unit
configuration man page for more details.

With the exception of JARFILE and APP_NAME, the above settings can be configured using
a .conf file. The file is expected next to the jar file and have the same name but
suffixed with .conf rather than .jar. For example, a jar named /var/myapp/myapp.jar
will use the configuration file named /var/myapp/myapp.conf.

myapp.conf.

JAVA_OPTS=-Xmx1024M
LOG_FOLDER=/custom/log/folder

Tip

You can use a CONF_FOLDER environment variable to customize the location of the
config file if you don’t like it living next to the jar.

59.3 Microsoft Windows services

Spring Boot application can be started as Windows service using
winsw.

A sample maintained separately
to the core of Spring Boot describes step-by-step how you can create a Windows service for
your Spring Boot application.

60. What to read next

Check out the Cloud Foundry,
Heroku, OpenShift and
Boxfuse web sites for more information about the kinds of features
that a PaaS can offer. These are just four of the most popular Java PaaS providers, since
Spring Boot is so amenable to cloud-based deployment you’re free to consider other
providers as well.

Part VII. Spring Boot CLI

The Spring Boot CLI is a command line tool that can be used if you want to quickly
develop with Spring. It allows you to run Groovy scripts, which means that you have a
familiar Java-like syntax, without so much boilerplate code. You can also bootstrap
a new project or write your own command for it.

61. Installing the CLI

The Spring Boot CLI can be installed manually; using SDKMAN! (the SDK Manager)
or using Homebrew or MacPorts if you are an OSX user. See
Section 10.2, “Installing the Spring Boot CLI”
in the “Getting started” section for comprehensive installation instructions.

62. Using the CLI

Once you have installed the CLI you can run it by typing spring. If you run spring
without any arguments, a simple help screen is displayed:

To pass command line arguments to the application, you need to use a -- to separate
them from the “spring” command arguments, e.g.

$ spring run hello.groovy -- --server.port=9000

To set JVM command line arguments you can use the JAVA_OPTS environment variable, e.g.

$ JAVA_OPTS=-Xmx1024m spring run hello.groovy

62.1.1 Deduced “grab” dependencies

Standard Groovy includes a @Grab annotation which allows you to declare dependencies
on a third-party libraries. This useful technique allows Groovy to download jars in the
same way as Maven or Gradle would, but without requiring you to use a build tool.

Spring Boot extends this technique further, and will attempt to deduce which libraries
to “grab” based on your code. For example, since the WebApplication code above uses
@RestController annotations, “Tomcat” and “Spring MVC” will be grabbed.

The following items are used as “grab hints”:

Items

Grabs

JdbcTemplate, NamedParameterJdbcTemplate, DataSource

JDBC Application.

@EnableJms

JMS Application.

@EnableCaching

Caching abstraction.

@Test

JUnit.

@EnableRabbit

RabbitMQ.

@EnableReactor

Project Reactor.

extends Specification

Spock test.

@EnableBatchProcessing

Spring Batch.

@MessageEndpoint@EnableIntegrationPatterns

Spring Integration.

@EnableDeviceResolver

Spring Mobile.

@Controller@RestController@EnableWebMvc

Spring MVC + Embedded Tomcat.

@EnableWebSecurity

Spring Security.

@EnableTransactionManagement

Spring Transaction Management.

Tip

See subclasses of
CompilerAutoConfiguration
in the Spring Boot CLI source code to understand exactly how customizations are applied.

62.1.2 Deduced “grab” coordinates

Spring Boot extends Groovy’s standard @Grab support by allowing you to specify a dependency
without a group or version, for example @Grab('freemarker'). This will consult Spring Boot’s
default dependency metadata to deduce the artifact’s group and version. Note that the default
metadata is tied to the version of the CLI that you’re using – it will only change when you move
to a new version of the CLI, putting you in control of when the versions of your dependencies
may change. A table showing the dependencies and their versions that are included in the default
metadata can be found in the appendix.

62.1.3 Default import statements

To help reduce the size of your Groovy code, several import statements are
automatically included. Notice how the example above refers to @Component,
@RestController and @RequestMapping without needing to use
fully-qualified names or import statements.

Tip

Many Spring annotations will work without using import statements. Try running
your application to see what fails before adding imports.

62.1.4 Automatic main method

Unlike the equivalent Java application, you do not need to include a
public static void main(String[] args) method with your Groovy scripts. A
SpringApplication is automatically created, with your compiled code acting as the
source.

62.1.5 Custom dependency management

By default, the CLI uses the dependency management declared in spring-boot-dependencies
when resolving @Grab dependencies. Additional dependency management, that will override
the default dependency management, can be configured using the @DependencyManagementBom
annotation. The annotation’s value should specify the coordinates
(groupId:artifactId:version) of one or more Maven BOMs.

For example, the following declaration:

@DependencyManagementBom("com.example.custom-bom:1.0.0")

Will pick up custom-bom-1.0.0.pom in a Maven repository under
com/example/custom-versions/1.0.0/.

When multiple BOMs are specified they are applied in the order that they’re declared.
For example:

indicates that dependency management in another-bom will override the dependency
management in custom-bom.

You can use @DependencyManagementBom anywhere that you can use @Grab, however, to
ensure consistent ordering of the dependency management, you can only use
@DependencyManagementBom at most once in your application. A useful source of
dependency management (that is a superset of Spring Boot’s dependency management) is the
Spring IO Platform, e.g.
@DependencyManagementBom('io.spring.platform:platform-bom:1.1.2.RELEASE').

62.2 Applications with multiple source files

You can use “shell globbing” with all commands that accept file input. This allows you
to easily use multiple files from a single directory, e.g.

$ spring run *.groovy

62.3 Packaging your application

You can use the jar command to package your application into a self-contained
executable jar file. For example:

$ spring jar my-app.jar *.groovy

The resulting jar will contain the classes produced by compiling the application and all
of the application’s dependencies so that it can then be run using java -jar. The jar
file will also contain entries from the application’s classpath. You can add explicit
paths to the jar using --include and --exclude (both are comma-separated, and both
accept prefixes to the values “+” and “-” to signify that they should be removed from
the defaults). The default includes are

public/**, resources/**, static/**, templates/**, META-INF/**, *

and the default excludes are

.*, repository/**, build/**, target/**, **/*.jar, **/*.groovy

See the output of spring help jar for more information.

62.4 Initialize a new project

The init command allows you to create a new project using start.spring.io
without leaving the shell. For example:

$ spring init --dependencies=web,data-jpa my-project
Using service at https://start.spring.io
Project extracted to '/Users/developer/example/my-project'

This creates a my-project directory with a Maven-based project using
spring-boot-starter-web and spring-boot-starter-data-jpa. You can list the
capabilities of the service using the --list flag

62.5 Using the embedded shell

Spring Boot includes command-line completion scripts for BASH and zsh shells. If you
don’t use either of these shells (perhaps you are a Windows user) then you can use the
shell command to launch an integrated shell.

It will uninstall the artifacts identified by the coordinates you supply and their
dependencies.

To uninstall all additional dependencies you can use the --all option. For example:

$ spring uninstall --all

63. Developing application with the Groovy beans DSL

Spring Framework 4.0 has native support for a beans{} “DSL” (borrowed from
Grails), and you can embed bean definitions in your Groovy
application scripts using the same format. This is sometimes a good way to include
external features like middleware declarations. For example:

You can mix class declarations with beans{} in the same file as long as they stay at
the top level, or you can put the beans DSL in a separate file if you prefer.

64. Configuring the CLI with settings.xml

The Spring Boot CLI uses Aether, Maven’s dependency resolution engine, to resolve
dependencies. The CLI makes use of the Maven configuration found in ~/.m2/settings.xml
to configure Aether. The following configuration settings are honored by the CLI:

65. What to read next

There are some sample groovy
scripts available from the GitHub repository that you can use to try out the
Spring Boot CLI. There is also extensive Javadoc throughout the
source code.

If you find that you reach the limit of the CLI tool, you will probably want to look
at converting your application to full Gradle or Maven built “groovy project”. The
next section covers Spring Boot’s
Build tool plugins that you can
use with Gradle or Maven.

Part VIII. Build tool plugins

Spring Boot provides build tool plugins for Maven and Gradle. The plugins offer a
variety of features, including the packaging of executable jars. This section provides
more details on both plugins, as well as some help should you need to extend an
unsupported build system. If you are just getting started, you might want to read
“Chapter 13, Build systems” from the
Part III, “Using Spring Boot” section first.

66. Spring Boot Maven plugin

The Spring Boot Maven Plugin provides Spring Boot
support in Maven, allowing you to package executable jar or war archives and run an
application “in-place”. To use it you must be using Maven 3.2 (or better).

This configuration will repackage a jar or war that is built during the package phase of
the Maven lifecycle. The following example shows both the repackaged jar, as well as the
original jar, in the target directory:

66.2 Packaging executable jar and war files

Once spring-boot-maven-plugin has been included in your pom.xml it will automatically
attempt to rewrite archives to make them executable using the spring-boot:repackage
goal. You should configure your project to build a jar or war (as appropriate) using the
usual packaging element:

Your existing archive will be enhanced by Spring Boot during the package phase. The
main class that you want to launch can either be specified using a configuration option,
or by adding a Main-Class attribute to the manifest in the usual way. If you don’t
specify a main class the plugin will search for a class with a
public static void main(String[] args) method.

To build and run a project artifact, you can type the following:

$ mvn package
$ java -jar target/mymodule-0.0.1-SNAPSHOT.jar

To build a war file that is both executable and deployable into an external container you
need to mark the embedded container dependencies as “provided”, e.g:

Advanced configuration options and examples are available in the
plugin info page.

67. Spring Boot Gradle plugin

The Spring Boot Gradle Plugin provides Spring Boot support in Gradle, allowing you to
package executable jar or war archives, run Spring Boot applications and use the
dependency management provided by spring-boot-dependencies. It requires Gradle 3.4 or
later. Please refer to the plugin’s documentation to learn more:

68. Spring Boot AntLib module

The Spring Boot AntLib module provides basic Spring Boot support for Apache Ant. You can
use the module to create executable jars. To use the module you need to declare an
additional spring-boot namespace in your build.xml:

68.2 spring-boot:findmainclass

The findmainclass task is used internally by exejar to locate a class declaring a
main. You can also use this task directly in your build if needed. The following
attributes are supported

Attribute

Description

Required

classesroot

The root directory of Java class files

Yes (unless mainclass is specified)

mainclass

Can be used to short-circuit the main class search

No

property

The Ant property that should be set with the result

No (result will be logged if unspecified)

68.2.1 Examples

Find and log.

<findmainclassclassesroot="target/classes" />

Find and set.

<findmainclassclassesroot="target/classes"property="main-class" />

Override and set.

<findmainclassmainclass="com.foo.MainClass"property="main-class" />

69. Supporting other build systems

If you want to use a build tool other than Maven, Gradle or Ant, you will likely need to
develop your own plugin. Executable jars need to follow a specific format and certain
entries need to be written in an uncompressed form (see the
executable jar format section
in the appendix for details).

The Spring Boot Maven and Gradle plugins both make use of spring-boot-loader-tools to
actually generate jars. You are also free to use this library directly yourself if you
need to.

69.1 Repackaging archives

To repackage an existing archive so that it becomes a self-contained executable archive
use org.springframework.boot.loader.tools.Repackager. The Repackager class takes a
single constructor argument that refers to an existing jar or war archive. Use one of the
two available repackage() methods to either replace the original file or write to a new
destination. Various settings can also be configured on the repackager before it is
run.

69.2 Nested libraries

When repackaging an archive you can include references to dependency files using the
org.springframework.boot.loader.tools.Libraries interface. We don’t provide any
concrete implementations of Libraries here as they are usually build system specific.

If your archive already includes libraries you can use Libraries.NONE.

69.3 Finding a main class

If you don’t use Repackager.setMainClass() to specify a main class, the repackager will
use ASM to read class files and attempt to find a suitable class
with a public static void main(String[] args) method. An exception is thrown if more
than one candidate is found.

70. What to read next

If you’re interested in how the build tool plugins work you can
look at the spring-boot-tools module on GitHub. More
technical details of the executable
jar format are covered in the appendix.

If you have specific build-related questions you can check out the
“how-to” guides.

Part IX. ‘How-to’ guides

This section provides answers to some common ‘how do I do that…​’ type of questions
that often arise when using Spring Boot. This is by no means an exhaustive list, but it
does cover quite a lot.

If you are having a specific problem that we don’t cover here, you might want to check out
stackoverflow.com to see if someone has
already provided an answer; this is also a great place to ask new questions (please use
the spring-boot tag).

We’re also more than happy to extend this section; If you want to add a ‘how-to’ you
can send us a pull request.

71. Spring Boot application

71.1 Create your own FailureAnalyzer

FailureAnalyzer is a great way
to intercept an exception on startup and turn it into a human-readable message, wrapped
into a FailureAnalysis. Spring
Boot provides such analyzer for application context related exceptions, JSR-303
validations and more. It is actually very easy to create your own.

AbstractFailureAnalyzer is a convenient extension of FailureAnalyzer that checks the
presence of a specified exception type in the exception to handle. You can extend from
that so that your implementation gets a chance to handle the exception only when it is
actually present. If for whatever reason you can’t handle the exception, return null
to give another implementation a chance to handle the exception.

FailureAnalyzer implementations are to be registered in a META-INF/spring.factories:
the following registers ProjectConstraintViolationFailureAnalyzer:

71.2 Troubleshoot auto-configuration

The Spring Boot auto-configuration tries its best to ‘do the right thing’, but
sometimes things fail and it can be hard to tell why.

There is a really useful ConditionEvaluationReport available in any Spring Boot
ApplicationContext. You will see it if you enable DEBUG logging output. If you use
the spring-boot-actuator there is also an autoconfig endpoint that renders the report
in JSON. Use that to debug the application and see what features have been added (and
which not) by Spring Boot at runtime.

Many more questions can be answered by looking at the source code and the Javadoc. Some
rules of thumb:

Look for classes called *AutoConfiguration and read their sources, in particular the
@Conditional* annotations to find out what features they enable and when. Add
--debug to the command line or a System property -Ddebug to get a log on the
console of all the auto-configuration decisions that were made in your app. In a running
Actuator app look at the autoconfig endpoint (‘/autoconfig’ or the JMX equivalent) for
the same information.

Look for classes that are @ConfigurationProperties (e.g.
ServerProperties)
and read from there the available external configuration options. The
@ConfigurationProperties has a name attribute which acts as a prefix to external
properties, thus ServerProperties has prefix="server" and its configuration properties
are server.port, server.address etc. In a running Actuator app look at the
configprops endpoint.

Look for use of RelaxedPropertyResolver to pull configuration values explicitly out of the
Environment. It often is used with a prefix.

Look for @Value annotations that bind directly to the Environment. This is less
flexible than the RelaxedPropertyResolver approach, but does allow some relaxed binding,
specifically for OS environment variables (so CAPITALS_AND_UNDERSCORES are synonyms
for period.separated).

Look for @ConditionalOnExpression annotations that switch features on and off in
response to SpEL expressions, normally evaluated with placeholders resolved from the
Environment.

71.3 Customize the Environment or ApplicationContext before it starts

A SpringApplication has ApplicationListeners and ApplicationContextInitializers that
are used to apply customizations to the context or environment. Spring Boot loads a number
of such customizations for use internally from META-INF/spring.factories. There is more
than one way to register additional ones:

Programmatically per application by calling the addListeners and addInitializers
methods on SpringApplication before you run it.

Declaratively per application by setting context.initializer.classes or
context.listener.classes.

Declaratively for all applications by adding a META-INF/spring.factories and packaging
a jar file that the applications all use as a library.

The SpringApplication sends some special ApplicationEvents to the listeners (even
some before the context is created), and then registers the listeners for events published
by the ApplicationContext as well. See
Section 23.5, “Application events and listeners” in the
‘Spring Boot features’ section for a complete list.

It is also possible to customize the Environment before the application context is
refreshed using EnvironmentPostProcessor. Each implementation should be registered in
META-INF/spring.factories: